Behavioral task
behavioral1
Sample
f3b9779af051cc2d06fa6eb8b9d1859a_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f3b9779af051cc2d06fa6eb8b9d1859a_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f3b9779af051cc2d06fa6eb8b9d1859a_JaffaCakes118
-
Size
156KB
-
MD5
f3b9779af051cc2d06fa6eb8b9d1859a
-
SHA1
30113f1313c0f3b96d8f71608b23703039b9c753
-
SHA256
41efee3b651e1ea3cc4f37bfc2470a73af92d282039adc87e233f944a4bbfbc9
-
SHA512
fef55c80ad9408aeddecf26b229bd2b8c97182b0fe6bb02d7f0590e49d45b109ea0dd45cb469e12220e9d937b86ea13b2c1ec735886d72f2ba2fe682f2872dbc
-
SSDEEP
3072:5V+NUTCnJJpm7sohK4VXA5hi3iZmjPLEhWmwQAsiTCiNP5:5VIUuzY7bhVX43ZmjPLEhWmwKiTCcP
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f3b9779af051cc2d06fa6eb8b9d1859a_JaffaCakes118
Files
-
f3b9779af051cc2d06fa6eb8b9d1859a_JaffaCakes118.dll windows:4 windows x86 arch:x86
2744aa2441be1e0eab75dcd8287cb98d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDC
gdi32
Rectangle
advapi32
RegOpenKeyA
Sections
.text Size: - Virtual size: 115KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 148KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ