DLLCALL
Behavioral task
behavioral1
Sample
ea43647d453bb1aa842599bff4fcd5e0_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ea43647d453bb1aa842599bff4fcd5e0_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
ea43647d453bb1aa842599bff4fcd5e0_JaffaCakes118
-
Size
624KB
-
MD5
ea43647d453bb1aa842599bff4fcd5e0
-
SHA1
3d9cbb7503d022333aea301b1751e2eb21410eaf
-
SHA256
4b6c54dccd90bef13be61fa962489d8db6b6b0548569e80d37b405259d66bc61
-
SHA512
16c060b82ddc59852bfada82500e1d67ba1de4803d1ca86c1c7472057a684751dd3194dad1e86899d84d959edd32eeecaa9d016b4f71aaa713fc94aad6ed03b6
-
SSDEEP
12288:RQWVXf2piaQpKbttskEboiRXYZMQMdEMWC5KJ+Z8eBW6koWr03:RpGiaYkEEPZYEMWKKwgJrG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea43647d453bb1aa842599bff4fcd5e0_JaffaCakes118
Files
-
ea43647d453bb1aa842599bff4fcd5e0_JaffaCakes118.dll windows:4 windows x86 arch:x86
3136b2742819ea028d9bcdb20edb3244
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetStdHandle
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
OpenClipboard
gdi32
CreateRectRgnIndirect
winmm
waveOutReset
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
RegisterTypeLi
comctl32
ImageList_Read
ws2_32
ioctlsocket
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 896KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 608KB - Virtual size: 606KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ