Behavioral task
behavioral1
Sample
00efb0d00e8ecea883e12c78a339046f_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
00efb0d00e8ecea883e12c78a339046f_JaffaCakes118.dll
Resource
win10v2004-20240419-en
General
-
Target
00efb0d00e8ecea883e12c78a339046f_JaffaCakes118
-
Size
157KB
-
MD5
00efb0d00e8ecea883e12c78a339046f
-
SHA1
de5c5c278bb2cec4db6f66d83334a74f66267d97
-
SHA256
3f0fa6a41d35c06c6dcfa62a63cd370f653bf4869379582931ac417c746fe70e
-
SHA512
fdedfe7dcfa264b7f5cbcb1fdc50b8d565e47fbc11d28ff0be8570beabc48ad49734aead8ff1751b378c1ba83cb21e9cb178b0cdd4bacc93143a45f7ecd5ce25
-
SSDEEP
3072:1nvtIWvacDu3oEZvjZDcj+iEoG5b8Ag0bA3V2Ss06NFQ:1vtIk1uYEFFDca8AbSaF
Malware Config
Signatures
-
Detect Lumma Stealer payload V4 1 IoCs
Processes:
resource yara_rule sample family_lumma_v4 -
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 00efb0d00e8ecea883e12c78a339046f_JaffaCakes118
Files
-
00efb0d00e8ecea883e12c78a339046f_JaffaCakes118.dll windows:6 windows x86 arch:x86
1be39e08d7f1e8d4b3dca7f5f3e81d1f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleA
Sleep
DisableThreadLibraryCalls
CreateThread
ExitProcess
IsBadCodePtr
CloseHandle
WriteConsoleW
DecodePointer
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
HeapReAlloc
HeapSize
SetStdHandle
GetStringTypeW
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
EncodePointer
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateFileW
user32
MessageBeep
ScreenToClient
GetCursorPos
SetRect
GetForegroundWindow
MessageBoxA
GetAsyncKeyState
shell32
ShellExecuteA
d3dx9_43
D3DXCreateFontA
D3DXCreateSprite
wininet
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
InternetOpenA
Sections
.text Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ