DllRegisterServer
Behavioral task
behavioral1
Sample
191f0a5dd7622595d3d38decf8061c05_JaffaCakes118.dll
Resource
win7-20231129-en
General
-
Target
191f0a5dd7622595d3d38decf8061c05_JaffaCakes118
-
Size
3.0MB
-
MD5
191f0a5dd7622595d3d38decf8061c05
-
SHA1
bded0a27fd4b759642720f8fbd4470a168f75576
-
SHA256
e7636efbaf3e170af8f7cbc36f4c030f3df0bc89547186ddfe03e66a5c8c0b92
-
SHA512
a1d2f5b4055c705f4e6f0394ff8b10127c8802d96e87722a34a6eaa0968d34853a9279de497d837c8b45c439e763bb2a65f4207c7e9db1a1165cbc99c96fa952
-
SSDEEP
49152:EBKs6yFyQqn4ZvgZ3aj+wvLoK/DVcONC/LzUX0QrxwyrIrP1VRmmnsQYp:EB36Sy94y3ajroKbCDoWPRT
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 191f0a5dd7622595d3d38decf8061c05_JaffaCakes118
Files
-
191f0a5dd7622595d3d38decf8061c05_JaffaCakes118.dll regsvr32 windows:6 windows x64 arch:x64
3de301e08dd1ae399d773905af5ee028
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
shell32
SHGetFolderPathA
user32
wsprintfA
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetUserNameA
kernel32
CreateProcessA
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
winhttp
WinHttpQueryDataAvailable
msvcrt
memset
Exports
Exports
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
bss Size: - Virtual size: 8B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ