Behavioral task
behavioral1
Sample
42b5c622d741883ae0cef84e43002475_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
42b5c622d741883ae0cef84e43002475_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
42b5c622d741883ae0cef84e43002475_JaffaCakes118
-
Size
200KB
-
MD5
42b5c622d741883ae0cef84e43002475
-
SHA1
6deb94e5253d34c8a70424150ef9fd1c653baa94
-
SHA256
e2de62c3e04b9c67e73d81a4094efbe1346adfe7c64343b7c65ef0d217432bd5
-
SHA512
c878e50a801b40c19b1257b3a0b73ff01be75714e602829f116a42fd3d103d0e0de8378e494b9ec8573d2caffc3c2e22c05e0cca30a9c05a85be6b6f3e589239
-
SSDEEP
6144:VDHXjdYDB8km/fjl2cYh5bVp015lS4E+/T:pXjdYDm/UThJVM/T
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 42b5c622d741883ae0cef84e43002475_JaffaCakes118
Files
-
42b5c622d741883ae0cef84e43002475_JaffaCakes118.dll windows:4 windows x86 arch:x86
1062f0bdc8e9ea84e928b23e11b5652b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WideCharToMultiByte
GetModuleHandleA
LoadLibraryA
VirtualAlloc
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Sections
.text Size: - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 192KB - Virtual size: 188KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ