Behavioral task
behavioral1
Sample
0ba650e7d6b924717429925f43e8f5fc_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0ba650e7d6b924717429925f43e8f5fc_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
0ba650e7d6b924717429925f43e8f5fc_JaffaCakes118
-
Size
93KB
-
MD5
0ba650e7d6b924717429925f43e8f5fc
-
SHA1
e9e17493f63683dc85081aaf9d371112d6537385
-
SHA256
e54ac2b5b20284e55d6848a886fdda587487574f1cec443b7489daa5618ea11e
-
SHA512
92c1ff4c49a8e6cfcd47a4de47e08449990122482d65c0b8441d9e54d546f6afab9556838215f5f81c6f282030c69999096dca9d0216dc5fe8db8ab3c93465d8
-
SSDEEP
1536:vIvqNbKAv836sYVf6HLp/ZL91draP+auMNy7B9GaReYSIqrcRh3GhU+6srO+hZbR:7oqjVSHF/jY+auMNy7bBRgDIb6O+hZ1
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ba650e7d6b924717429925f43e8f5fc_JaffaCakes118
Files
-
0ba650e7d6b924717429925f43e8f5fc_JaffaCakes118.dll windows:5 windows x86 arch:x86
4782b6ec4bcba88d137a635fd3f2970d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
IsDebuggerPresent
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
MessageBoxA
gdi32
GetTextExtentPoint32A
d3d9
Direct3DCreate9
msvcr90
_lock
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 91KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ