Behavioral task
behavioral1
Sample
61005d38ec15fd62f936139df848d9fd_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
61005d38ec15fd62f936139df848d9fd_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
61005d38ec15fd62f936139df848d9fd_JaffaCakes118
-
Size
122KB
-
MD5
61005d38ec15fd62f936139df848d9fd
-
SHA1
1ce7bd47c91db11b923e1fb495b9f3b9c67e976f
-
SHA256
3d30325a90a6c9c310b07946545adeb716b0a88e983ff0442bac8fafb4613e09
-
SHA512
12367fa6991066161c1b9ca535ae7464d2f2051183141cb449cf38d157230282846b0d99fe861384aac5263fa417950ceaa1201eca3ede6fc63d8c383cc2177a
-
SSDEEP
3072:sps19Czl31JDo8zQPmTYYbjG0d3jJImX+7VvsjQu1kC:6s1IvJDPzQPmTY8z9NIPJsj9b
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
61005d38ec15fd62f936139df848d9fd_JaffaCakes118.dll windows:4 windows x86 arch:x86
0184b614c0ed983284488ea2068735c4
Code Sign
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10/01/1997, 07:00Not After31/12/2020, 07:00SubjectCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporationc1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10/01/1997, 07:00Not After31/12/2020, 07:00SubjectCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation61:47:52:ba:00:00:00:00:00:04Certificate
IssuerCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16/09/2006, 01:53Not After16/09/2011, 02:03SubjectCN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
61:47:52:ba:00:00:00:00:00:04Certificate
IssuerCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16/09/2006, 01:53Not After16/09/2011, 02:03SubjectCN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before16/09/2006, 01:04Not After15/09/2019, 07:00SubjectCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
61:02:30:7e:00:00:00:00:00:06Certificate
IssuerCN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before10/03/2008, 21:57Not After10/06/2009, 22:07SubjectCN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before11/10/2005, 21:55Not After26/04/2010, 07:00SubjectCN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
b6:48:eb:9c:67:5c:b2:d7:a9:75:31:1d:33:97:c3:1d:97:ed:ab:66Signer
Actual PE Digestb6:48:eb:9c:67:5c:b2:d7:a9:75:31:1d:33:97:c3:1d:97:ed:ab:66Digest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpynA
WinExec
MoveFileExA
GetTickCount
SetThreadPriority
GetCurrentThread
GetFileSize
CreateFileA
WriteFile
GetModuleFileNameA
GlobalMemoryStatus
GetVersionExA
GetComputerNameA
InterlockedExchange
HeapAlloc
GetProcessHeap
GetCurrentProcessId
GetCurrentThreadId
CreateThread
WaitForSingleObject
lstrcpyA
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Module32First
OpenProcess
GetPriorityClass
Process32Next
lstrlenA
SetLastError
GetCurrentProcess
MoveFileA
CopyFileA
DeleteFileA
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLastError
FindNextFileA
FindClose
LoadLibraryA
Sleep
GetProcAddress
FreeLibrary
CreatePipe
CloseHandle
GetStartupInfoA
GetSystemDirectoryA
CreateProcessA
ReadFile
FreeConsole
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
mouse_event
CreateWindowExA
CloseWindow
SendMessageA
IsWindow
GetSystemMetrics
SetThreadDesktop
ExitWindowsEx
SetProcessWindowStation
OpenWindowStationA
GetThreadDesktop
GetProcessWindowStation
CloseDesktop
CloseWindowStation
SetCursorPos
GetDesktopWindow
wsprintfA
keybd_event
OpenDesktopA
MessageBoxA
gdi32
CreateCompatibleBitmap
GetDIBits
CreateDCA
DeleteDC
CreateCompatibleDC
SelectObject
DeleteObject
BitBlt
advapi32
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
SetServiceStatus
RegisterServiceCtrlHandlerA
DeleteService
CreateServiceA
RegOpenKeyA
RegCreateKeyA
RegOpenKeyExA
RegSetValueExA
QueryServiceStatus
CloseServiceHandle
StartServiceA
ChangeServiceConfigA
OpenServiceA
OpenSCManagerA
ControlService
RegCloseKey
shell32
ShellExecuteA
SHGetFileInfoA
msvcrt
wcstombs
_adjust_fdiv
_initterm
free
_onexit
__dllonexit
??1type_info@@UAE@XZ
malloc
srand
rand
_strlwr
_ftol
strstr
strcspn
atoi
??3@YAXPAX@Z
_except_handler3
_CxxThrowException
__CxxFrameHandler
strncat
sprintf
strncpy
??2@YAPAXI@Z
avicap32
capCreateCaptureWindowA
capGetDriverDescriptionA
ws2_32
recv
gethostbyname
inet_addr
WSAStartup
shutdown
closesocket
connect
socket
htons
sendto
htonl
WSASocketA
setsockopt
WSAIoctl
send
shlwapi
StrStrIA
Exports
Exports
Install
RundllInstall
RundllUninstall
ServiceMain
�M�{� ���SBJw�t5��� "�㦐�4 �4�X2��{���"C-�h�����D� r����8����VM�j�����BQ��R���B�� F��ڣ�ʜ���!���E�.W�;�*7��s�7 ��{����J8�ʈ��p%0����0����7���}4�V_��햱ݵ�^�$qa)^Zl�+ ���*�o^B�x�H���z���8�-����ʡ�XF���as>�X10Y��ށC��bg��"(���`��1�v�/ɽX�A�7�ld̉zof.�Pc͞�t%����\$,���3��K�����f�G+����� �@;OD��v��Y(�=zN>cy�d��dkBWP2Qe݂�~u�XX ��R���c�p�m����ORz��:+�W��]v�ѥ�r�W�t�U6J�i��=n?�Ѥ��|`����-H���yk�h�`�ua*�tm}:��D]�|��g�&)mEvKLA��_f�M�g����� K��JdoO)0e�m?���q���J� lU4��z�-n槜��Ͱ ��n��)7�>�!%�М y����=/c�3z���>��CDI�9���i��|T}5HheEJ�)�i��}8�C= Sp��QK��P�!���{�y�n�5�^^�,k2�3۹�~�C7�Ӡ�S������P�&�ˇҹx���å������?����L%*��ʪ:�n��&�"�{��������v������r�����@�T�En�S8��m�>M�1��Xܧ�u��%T��[�hp�`�\$�D��������ז ���"@Iܙ>�Q!�u��˧&��.�� 7����tUٿ�i���z�2��v���*Q�w�����o9�0����k:j�g��.S�eE-�=d�'.�o�a��N���#Ig�C���}!1�#@/�H'Y�2��kd�.<�|ˡ�0�v�P��p����2r]��5pA(�i�ϱ��P�M�-�>������7)a���A]�Uq�i� �����N����{ ���?��=�M�t'�g({Q�2ޒ��S�v������l0���wm;R��jVKNJ� #M� �Ԏ���N@o$��ŀ{��_���u%$�+n�� V3co92�J����q�����R��;{�N��%�Yﶶ���%�4VL�����x��.:Û�M���������ퟳ�����f�/��/e��'�u�eq�H~�A�`fO!�0�2�iET`�����%.ɮARW6�3�i�J%n�Y��D0m�;2»�������O�tS��Y�Ax�־��n_�/����A��D 0�; ������K���5�?B���d����֏Q��+k �:��a���66@���;�R6p%�z�0�'��xU��5�Na_�6�����j�� ����I���Y�J ��9�~�#Ne�jVNO�@����@:�2m ����x,,���o ��88�+���n�}�Z�'�B.�9։q��J1h\!���s�/�ۂ<�(��Ye\���%hku�`�j�:����8u���Y�؞��n����B��8��j�{q�$�#����6'�Ap1���w �q�|P:q�_��R]�\��y ����ҫW�V�!n*�c���h�ۀ�z;J�لw(X�A֍G��sV:N䪩�,��d���0�S�?+�a���v��<E��C���;��k�0����Z5��,��|b��"�)�P�+r�ۛ�~����p-�L�Ճ.�u����x�"1G!����)���Xؚx�]�vn+��� _�ӄ��8��L���6Xu�9E�w�2��6QLiE��@uMq�Q��KL��Z���>T�7 ����A�����P�69��a��y��3`/O��O�|�~ׅTY%! �^]Q,�gJ?g>��x/�xW)���%����c�d�qhPT҄�x���-d/�^���u�=����XWH#{y�����K�V=�6�C�����B)��Z9�3� ?o�����9P���V����L��D�؋������� (�KdX��.��&��a`�@9�!*J�]&^��{�I�k��%{�#i��n���יG�|�Ǹf"��͍^ّ��B���:A��aY��%c��U�k��� ���Y��}�h��X��Z������������HO�Cu�N�7h"�&�ez��v��^��������!��PhsZ�~<�7�-�ȭ;���������>@�������M�C`;�3�y芌(8Q_��R��d�S��:�!U8�K����È�lR/銊n��-S:��.]�x<��Y<�\D���2=݄��̡��s����KNJ���~ YJ��O|�� ���ew�57n7�3hE��LUn�9� ���V�X�T�U��j���[�[M�KRk���o�շn����g�Ͳ��kM��b)(Z����S�"Hp �m��I)q��tOa!��uaY~��D2�]h��*���*+g=ޡ�����T�C�?��n�@\�,^C)+��P��?*�u�<����tS���\����D��d�kucV���b]��a �9��b���I�s����5�A��E'�M<O���]qR������x�n����[�7VC�ψ�ɃG�lX��2Q��~�oF�i镖c^:D��$8�*��- ����{Q����Xn+��ʹ9�ʒ(i>�Lv�C��@f���"���R�_�:���ä�Qc=5�.����u�azJ"iaC=��X��rf}�� I��r�4�P്H0�}r�TSG��z��* ^����� �e"'�0m����܃el)��ɦ=av=��H�y��@*׆�+�J��n��7 �Ϻx�"��0�Z�ѳ49���1��4�צ���"Ӆ2�%S"/�0(�j��[.�$�"l���(���'� �����y��3J�Q�e��\@�a߄�`>:b�r;g�*U��ُ/�[~)��ZڋR/S����:�<$�ܣD�_�{ܵt��B��w���9��0�~�yB�2���w�<��̎�A�c��<O�Ĭd�\=�Ʊ�I�ɩC�2�]��2��C(�*�$�U煑=·��� Z�Fu�Q�����i��sw��*
Sections
.text Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ