Behavioral task
behavioral1
Sample
410a7793792a3dcb5f946111a18eeb1e_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
410a7793792a3dcb5f946111a18eeb1e_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
410a7793792a3dcb5f946111a18eeb1e_JaffaCakes118
-
Size
783KB
-
MD5
410a7793792a3dcb5f946111a18eeb1e
-
SHA1
c7c3409d75a878b675f63791bf9a58c7c3d46fa0
-
SHA256
3c695b22df421c9c1f0688beb7cfd8e29200f42dbb3b7d7c705968f81e4712c4
-
SHA512
22c1d0b3bebfedd22d4487ae61bb11467c5e56586d39c41068c71a0d025265a7ebde164f867f9add75211888ee04fee6e9933d43f5038dfc94a65b5558f4e117
-
SSDEEP
24576:HLeiMh0wDyI5nM5DRLHGrNGHryyM4YC9Fo6osiL:HqJMN0NUF56nFL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 410a7793792a3dcb5f946111a18eeb1e_JaffaCakes118
Files
-
410a7793792a3dcb5f946111a18eeb1e_JaffaCakes118.dll windows:5 windows x86 arch:x86
ad139e69fd2631483edfadd9394e5b96
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetUnhandledExceptionFilter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
UpdateWindow
shell32
ShellExecuteA
msvcp100
?_Xout_of_range@std@@YAXPBD@Z
wininet
InternetReadFile
msvcr100
sprintf_s
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 644KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 780KB - Virtual size: 779KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ