Behavioral task
behavioral1
Sample
03f2e8a113844bc15925579923efbe1f_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
03f2e8a113844bc15925579923efbe1f_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
03f2e8a113844bc15925579923efbe1f_JaffaCakes118
-
Size
96KB
-
MD5
03f2e8a113844bc15925579923efbe1f
-
SHA1
5c6689eeb9ec747a4027615b97e6f06b38a028a8
-
SHA256
93dbe7193615f7601f63fbaf479915a56960075542a4b32985d3978065e18119
-
SHA512
a83411e723f5d27e4078b8ad0ed4b1c18be2f2c8bea5cc39210737985d185447afab261b8db663060ffc3565b71245477c0c0c3fac6d748cbfab48d25dca0ad8
-
SSDEEP
3072:oMJmWKNgAJwrzoGctULeoM9oVOCMHFYNPN:9mT6Asojwe19ooCr
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03f2e8a113844bc15925579923efbe1f_JaffaCakes118
Files
-
03f2e8a113844bc15925579923efbe1f_JaffaCakes118.dll windows:4 windows x86 arch:x86
fedb7da80dcf0d5ae319f312fdafa740
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleFileNameA
WritePrivateProfileStringA
GetWindowsDirectoryA
IsBadStringPtrW
Module32Next
Module32First
CreateToolhelp32Snapshot
DeleteFileA
GetTempPathA
CreateFileMappingA
GetFileAttributesW
ReadProcessMemory
VirtualQueryEx
WideCharToMultiByte
GetPrivateProfileStringA
GetFileSize
CreateFileA
GetModuleHandleA
CreateThread
SetFilePointer
HeapAlloc
GetProcessHeap
OutputDebugStringA
OpenProcess
TerminateProcess
GetCurrentProcess
Sleep
GetCurrentThreadId
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
CloseHandle
GetProcAddress
LoadLibraryA
ReadFile
FreeLibrary
user32
GetWindowThreadProcessId
GetDC
GetWindowRect
wvsprintfA
GetClassNameW
wsprintfA
GetKeyboardState
ToAscii
SendMessageA
AttachThreadInput
GetFocus
FindWindowA
GetWindow
wininet
DeleteUrlCacheEntry
urlmon
URLDownloadToFileA
gdi32
DeleteDC
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
CreateDCA
msvcrt
wcsncat
wcscpy
wcsstr
exit
printf
wcslen
time
srand
rand
malloc
_stricmp
tolower
_vsnprintf
_ltoa
_strupr
_strcmpi
??3@YAXPAX@Z
wcscmp
??2@YAPAXI@Z
fclose
ftell
fseek
fopen
mbstowcs
_except_handler3
strlen
strcpy
memset
memcpy
free
strncpy
sprintf
strrchr
strstr
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ