jaffacakes118_UDS[.]DangerousObject[.]Multi[.]Generic[.]51b18e5d999f95b6dab895aee3164fce

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_UDS.DangerousObject.Multi.Generic.51b18e5d999f95b6dab895aee3164fce
Size 1024KB
Sample261014-npbcsacs5j
SHA256 a4054c5e6e7012254ee8186e7d551ff5ff4c130b0d74493d6740b19eaaced554
MD5 51b18e5d999f95b6dab895aee3164fce
SHA1 a5d5d0f0f8dcea523c3ff4137ac8bf93d4606c5c
SHA512 b0d68a29debbcb70a22f79bf67d983d1f71516e880b82c3da5ad31724eb036aff5a795252f5cd2c85ed8aef72ae305a5cd945e31cccef19158f2cd371e90142f
SSDEEP 24576:YMj3e9Y2rV8EBZJTf3Tm9a7TPKKBxmj7k7uCXVRufc:YMjoY2rJBZJTf3aA3KCxc2VA
TLSH
T1672523ECD958361CE4072F32558F4AEFEF765ADF81090AC19FF83A0425E12D9122AD6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_UDS.DangerousObject.Multi.Generic.51b18e5d999f95b6dab895aee3164fce

File Explorer

jaffacakes118_UDS.DangerousObject.Multi.Generic.51b18e5d999f95b6dab895aee3164fce

.exe 1024KB

jaffacakes118_UDS.DangerousObject.Multi.Generic.51b18e5d999f95b6dab895aee3164fce

IMPHASH 4ae5b58721dae2de23b03fe298a08d11
SHA256 a4054c5e6e7012254ee8186e7d551ff5ff4c130b0d74493d6740b19eaaced554
MD5 51b18e5d999f95b6dab895aee3164fce
SHA1 a5d5d0f0f8dcea523c3ff4137ac8bf93d4606c5c
SHA512 b0d68a29debbcb70a22f79bf67d983d1f71516e880b82c3da5ad31724eb036aff5a795252f5cd2c85ed8aef72ae305a5cd945e31cccef19158f2cd371e90142f
SSDEEP 24576:YMj3e9Y2rV8EBZJTf3Tm9a7TPKKBxmj7k7uCXVRufc:YMjoY2rJBZJTf3aA3KCxc2VA
TLSH
T1672523ECD958361CE4072F32558F4AEFEF765ADF81090AC19FF83A0425E12D9122AD6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2646101

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

525KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

Virtual Size

629KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

Virtual Size

261KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

1008KB

Virtual Size

1004KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

132B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

jaffacakes118_UDS.DangerousObject.Multi.Generic.51b18e5d999f95b6dab895aee3164fce

rasapi32

winmm

ws2_32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

wininet

comdlg32

generic