G:\projects\G\GamePluginCtrl\Release\gamePluginCtrl.pdb
Behavioral task
behavioral1
Sample
79b0d6ff647b8ede9666706e584c2340_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
79b0d6ff647b8ede9666706e584c2340_JaffaCakes118.dll
Resource
win10v2004-20240426-en
General
-
Target
79b0d6ff647b8ede9666706e584c2340_JaffaCakes118
-
Size
547KB
-
MD5
79b0d6ff647b8ede9666706e584c2340
-
SHA1
ddb507c9ba3d9a5c61353da6f13dc94f66e1e86b
-
SHA256
30eb4af623f74beb634b996daddf404c039f27678350f4da7b6a0ccd9d8ef61a
-
SHA512
b56165219925a59e52fbd4a6aa36b09b5353d9d1d5845356b8f767d209b375788f9a8ab388332824dd4e169a81ed367ef86ef55a3dff9db9313b52395ae32fc5
-
SSDEEP
12288:2etyNG/nlLQW8a1PiBEFT5SGI/IIvPCUjQhQ/KahIeYXmysy:2wT/lLQ3oFT5ROvHNQOCeUts
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 79b0d6ff647b8ede9666706e584c2340_JaffaCakes118
Files
-
79b0d6ff647b8ede9666706e584c2340_JaffaCakes118.dll windows:5 windows x86 arch:x86
79f3ef873a771d1e51d1f91bd4836217
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetVersionExA
ReadFile
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowRect
gdi32
SetMapMode
winspool.drv
OpenPrinterA
advapi32
StartServiceA
shell32
ShellExecuteExA
shlwapi
PathFindExtensionA
ole32
CoCreateInstance
oleaut32
VariantClear
psapi
GetModuleFileNameExA
ntdll
ZwQuerySystemInformation
fltlib
FilterConnectCommunicationPort
ws2_32
WSAStartup
Exports
Exports
AGS
ALDS
FGWAGT
GDTAN
GNBGT
GSCF
GSDNP
HINSD
IHJDE
IHPTE
ILST
INSHD
INSPD
ITCNE
PTCP
RDTP
RGALDS
SCTM
SGDI
SGGGI
SGHHI
SGSI
SGTHI
SPEP
SRF
Sections
.text Size: - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 334KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 542KB - Virtual size: 542KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ