jaffacakes118_Trojan[.]Win32[.]Agent[.]vbok[.]f6dcd66462276bcb6a1d396beaacdb12

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Agent.vbok.f6dcd66462276bcb6a1d396beaacdb12
Size 426KB
Sample261015-3za74atwhy
SHA256 781f81b657c710ab53eb61e846a6d1995c9e453816fb0690331fe91c6ed8bd8b
MD5 f6dcd66462276bcb6a1d396beaacdb12
SHA1 20342cc8b40b9232a5c54d6d5dc03a6fb45349c4
SHA512 155e6ab9a6184655d7d815f8705d8d3fef5a3c074f4864bac49ec8047989f8ceadb9fe508cddfda8266cf74395f6fa57b5b2ba11723120d6db6b3cf134ffefc5
SSDEEP 6144:81pT9UYkzlHX/cXfhq/dwzHm/GwQeeaQeeA3QeesQeeABQeehQee5EhjkV1VGoMs:cpT9UY6NvcXfhkdlYhj+LjBrQ736
TLSH
T122947E51EA654422C0FD673E054B537972BAAE018ED2C38B5DA8363F3E736D847216CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Agent.vbok.f6dcd66462276bcb6a1d396beaacdb12

File Explorer

jaffacakes118_Trojan.Win32.Agent.vbok.f6dcd66462276bcb6a1d396beaacdb12

.dll 426KB

jaffacakes118_Trojan.Win32.Agent.vbok.f6dcd66462276bcb6a1d396beaacdb12

IMPHASH f40b781c9b5cd0a06372ab1bed748676
SHA256 781f81b657c710ab53eb61e846a6d1995c9e453816fb0690331fe91c6ed8bd8b
MD5 f6dcd66462276bcb6a1d396beaacdb12
SHA1 20342cc8b40b9232a5c54d6d5dc03a6fb45349c4
SHA512 155e6ab9a6184655d7d815f8705d8d3fef5a3c074f4864bac49ec8047989f8ceadb9fe508cddfda8266cf74395f6fa57b5b2ba11723120d6db6b3cf134ffefc5
SSDEEP 6144:81pT9UYkzlHX/cXfhq/dwzHm/GwQeeaQeeA3QeesQeeABQeehQee5EhjkV1VGoMs:cpT9UY6NvcXfhkdlYhj+LjBrQ736
TLSH
T122947E51EA654422C0FD673E054B537972BAAE018ED2C38B5DA8363F3E736D847216CB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

444782

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

CreateThread VirtualProtect GetModuleHandleA Sleep IsBadReadPtr GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess InterlockedCompareExchange InterlockedExchange IsProcessorFeaturePresent GetSystemInfo OutputDebugStringA VirtualAlloc VirtualFree WideCharToMultiByte MultiByteToWideChar GetVersionExA LoadLibraryA GetProcAddress GetCurrentProcess FlushInstructionCache ExitProcess SetLastError GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

user32

FindWindowA GetDesktopWindow DefWindowProcA CreateWindowExA GetAsyncKeyState RegisterClassExA DestroyWindow

d3d9

Direct3DCreate9

msvcr90

_encode_pointer _malloc_crt _encoded_null _decode_pointer _initterm _initterm_e _amsg_exit _adjust_fdiv __CppXcptFilter _crt_debugger_hook __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _except_handler4_common floor free __CxxFrameHandler _finite _CIacos modf iswspace iswalpha iswdigit iswpunct strncpy _ftol memcpy memset ??2@YAPAXI@Z ??3@YAXPAX@Z __CxxFrameHandler3

gdi32

DeleteDC GetGlyphOutlineA SelectObject GetCharacterPlacementA GetTextMetricsA GetObjectW DeleteObject CreateDIBSection SetBkMode ExtTextOutW MoveToEx ExtTextOutA CreateCompatibleDC SetMapMode SetTextAlign CreateFontIndirectW CreateFontIndirectA GetFontLanguageInfo GetTextMetricsW SetBkColor SetTextColor GetCharacterPlacementW GetObjectA

advapi32

RegCloseKey RegOpenKeyA RegQueryValueExA

Name

.text

Size

197KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

685B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Agent.vbok.f6dcd66462276bcb6a1d396beaacdb12

kernel32

user32

d3d9

msvcr90

gdi32

advapi32

generic