jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]528e57665a2be1e987e7d4f9aadf3f25

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.528e57665a2be1e987e7d4f9aadf3f25
Size 112KB
Sample261014-dthbsaey91
SHA256 97fd71f1a280f4001a91af5fc2c545b37075f75b7b33101d63bfca655852cebf
MD5 528e57665a2be1e987e7d4f9aadf3f25
SHA1 03c710c0bff788f1d8565f03807c03b0e43a4bd5
SHA512 5ee9a29d0f5ec0ac60367ea6b91102ee61f5441e4fe3650cf046b60334e8448c679054975cae2a8cb618784f933129d6510f3a9256de0da14215b10d8ab9946b
SSDEEP 3072:v+w8uSMuB1L73Plkzgi75HJKfVHOmfPwtQsf1GJB:vV8uSMu/Hfvi1HJXmfPwtQuGf
TLSH
T1C1B3028336682EF6CCC79E3489AD9B4FFD1065C9CE19C67BC3885A12F66341433982E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.528e57665a2be1e987e7d4f9aadf3f25

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.528e57665a2be1e987e7d4f9aadf3f25

.exe 112KB

jaffacakes118_HEUR.Trojan.Win32.Generic.528e57665a2be1e987e7d4f9aadf3f25

IMPHASH 3adf9ec860cacad3b4b713938a49cfd6
SHA256 97fd71f1a280f4001a91af5fc2c545b37075f75b7b33101d63bfca655852cebf
MD5 528e57665a2be1e987e7d4f9aadf3f25
SHA1 03c710c0bff788f1d8565f03807c03b0e43a4bd5
SHA512 5ee9a29d0f5ec0ac60367ea6b91102ee61f5441e4fe3650cf046b60334e8448c679054975cae2a8cb618784f933129d6510f3a9256de0da14215b10d8ab9946b
SSDEEP 3072:v+w8uSMuB1L73Plkzgi75HJKfVHOmfPwtQsf1GJB:vV8uSMu/Hfvi1HJXmfPwtQuGf
TLSH
T1C1B3028336682EF6CCC79E3489AD9B4FFD1065C9CE19C67BC3885A12F66341433982E5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

49476

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

jaffacakes118_HEUR.Trojan.Win32.Generic.528e57665a2be1e987e7d4f9aadf3f25

kernel32

advapi32

msvcrt

user32

generic

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.528e57665a2be1e987e7d4f9aadf3f25

kernel32

advapi32

msvcrt

user32

generic