Behavioral task
behavioral1
Sample
355a9b170cbbc7ebccf3c5b141754414_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
355a9b170cbbc7ebccf3c5b141754414_JaffaCakes118
-
Size
124KB
-
MD5
355a9b170cbbc7ebccf3c5b141754414
-
SHA1
b25aa05b05561d14e0265e71ff781a7d9ae692ed
-
SHA256
40687cce9ab949e634f9364c253f23695e7cfa16fb795c90c5f8f61685fcc7bd
-
SHA512
1b64fc181967b9dc1b0c44e8b439fc41ed2adf6974e5ca74ff27cd1bd4745ba501e2b46ff913e47bdcb7d30ae92837ea9d785c8d6b9c8593c1cb3b5070ec3201
-
SSDEEP
3072:aATE4omm10PWPPYrvZOx2gy/3zRBHCQUDRt/h:aHaOPA1OyfzRBHET
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 355a9b170cbbc7ebccf3c5b141754414_JaffaCakes118
Files
-
355a9b170cbbc7ebccf3c5b141754414_JaffaCakes118.dll windows:4 windows x86 arch:x86
8466b036b96e09842e1dc7358466bf81
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetFileAttributesA
FindFirstFileA
ExitProcess
VirtualProtect
VirtualAlloc
RemoveDirectoryA
lstrcmpiA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
GetLastError
FindClose
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
GetAsyncKeyState
MessageBoxA
gdi32
GetTextExtentPointA
SelectObject
CreateFontA
DeleteObject
msvcrt
sscanf
vsprintf
pow
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
free
_initterm
malloc
_adjust_fdiv
memcpy
time
srand
rand
atof
atoi
system
_strlwr
_vsnprintf
_ftol
strstr
strcpy
acos
cos
sin
??3@YAXPAX@Z
??2@YAPAXI@Z
toupper
strlen
tolower
strcmp
__CxxFrameHandler
strcat
sprintf
atan2
sqrt
memset
_strcmpi
_strdup
strncpy
_strnicmp
msvcp60
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBDH@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADHD@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_F?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
winmm
timeGetTime
opengl32
wglUseFontBitmapsA
glGenLists
wglGetCurrentDC
glLineWidth
glColor3ub
glEnd
glBegin
glColor4ub
glBlendFunc
glEnable
glVertex2i
glDisable
glPopAttrib
glCallLists
glListBase
glPushAttrib
glHint
glRasterPos2i
Sections
.text Size: - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 116KB - Virtual size: 115KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ