Behavioral task
behavioral1
Sample
3c7acf717b8b80c9ace2d94774f9b5f4_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3c7acf717b8b80c9ace2d94774f9b5f4_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3c7acf717b8b80c9ace2d94774f9b5f4_JaffaCakes118
-
Size
140KB
-
MD5
3c7acf717b8b80c9ace2d94774f9b5f4
-
SHA1
71fa9d416e98bb53a8ad1c4a2b9932d549f9d5ab
-
SHA256
bff8094e5802da4c82462d6f3a02aefafe1a61642bd18337d30245a0648ecc97
-
SHA512
af8fcae455e93c948cfa5c0794b93b8a7c26575f6c8e0b95fd663e94e4f5ecd20a84bdcd1f1db12b5aeb603286cdddeb758b50a663c60dd20ec9fc1200526c52
-
SSDEEP
3072:wO7KQGink0S9DxglIJ2SxKy/5vxmhAA053rtogjVPrH4Myteh:vW00xmIJ2OKy/5vxmh0SYVb4Leh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c7acf717b8b80c9ace2d94774f9b5f4_JaffaCakes118
Files
-
3c7acf717b8b80c9ace2d94774f9b5f4_JaffaCakes118.dll windows:4 windows x86 arch:x86
d6f03d312952042b34b6cf60adbd7b5b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
GetSystemInfo
GetProcAddress
GetCurrentProcessId
CloseHandle
CreateToolhelp32Snapshot
Module32First
Module32Next
VirtualQuery
WriteProcessMemory
VirtualProtect
GetCurrentProcess
lstrcmpiA
LoadLibraryA
LoadLibraryW
LoadLibraryExA
LoadLibraryExW
ReadProcessMemory
VirtualProtectEx
GetLastError
VirtualQueryEx
VirtualFreeEx
CreateRemoteThread
VirtualAllocEx
GetModuleFileNameA
ResumeThread
CreateProcessA
Sleep
GetLocalTime
CompareStringW
CompareStringA
RtlUnwind
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
MultiByteToWideChar
ReadFile
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
ExitProcess
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
DeleteCriticalSection
FatalAppExitA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
SetFilePointer
SetStdHandle
CreateFileA
InitializeCriticalSection
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetTimeZoneInformation
GetLocaleInfoW
SetEnvironmentVariableA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
imagehlp
ImageDirectoryEntryToData
Sections
.text Size: - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 128KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ