Behavioral task
behavioral1
Sample
1a2b0609c806176a7d60ed2ee1e6d364_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1a2b0609c806176a7d60ed2ee1e6d364_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1a2b0609c806176a7d60ed2ee1e6d364_JaffaCakes118
-
Size
834KB
-
MD5
1a2b0609c806176a7d60ed2ee1e6d364
-
SHA1
73dbb4bd9208fe5fdee81dba6591f927853e9835
-
SHA256
9650f01e7a4560b74002e9eeb5c4be3a721b0fe1e2c1ed346966440c7ff945c8
-
SHA512
6f36b03e95811804d7188c91d6fe0d51e536c08989bd7ae7ba94290a2ee339f36f1341e36cc791a7437becdd3b7f2a3ff2c136739353f2bf0fa940034e922928
-
SSDEEP
24576:pOedrWQejbV5ly0M3m8NYwHxShwdFv3YYjzvnVdk72:pprWQGbb40MhZQkFRjVa72
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1a2b0609c806176a7d60ed2ee1e6d364_JaffaCakes118
Files
-
1a2b0609c806176a7d60ed2ee1e6d364_JaffaCakes118.exe windows:5 windows x86 arch:x86
3389ea88c8332b1663a25a7bbe628398
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
gethostname
version
GetFileVersionInfoSizeW
winmm
mciSendStringW
comctl32
ImageList_SetDragCursorImage
mpr
WNetCancelConnection2W
wininet
InternetConnectW
psapi
GetProcessMemoryInfo
userenv
CreateEnvironmentBlock
kernel32
GetEnvironmentVariableW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetFocus
gdi32
AngleArc
comdlg32
GetSaveFileNameW
advapi32
CreateProcessWithLogonW
shell32
SHBrowseForFolderW
ole32
CoSetProxyBlanket
oleaut32
VarR8FromDec
Sections
.text Size: - Virtual size: 512KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 358KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 696KB - Virtual size: 696KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE