Behavioral task
behavioral1
Sample
76bc148abe806f63a711267cac3455fd_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
76bc148abe806f63a711267cac3455fd_JaffaCakes118
-
Size
84KB
-
MD5
76bc148abe806f63a711267cac3455fd
-
SHA1
388ca3b3fb05dc04ecede22fce8650f7a6eef39e
-
SHA256
157713c5c0f232d61832874df52ad200a31c5de660eb5a45194186c07f6e134b
-
SHA512
22581bd25205ccf96df4fa4c5374c5e65daeb17c5fce77d6081da6dfc6659727226860d1107aef9e139e9abd79f27bdab3ec6dc50e00e6677494fcc8f5619d74
-
SSDEEP
1536:lnH1db8yO6h2BaZcj6qsbROtOjC5QlExHrWjp+6:RUdUsBsFuOjyxdyc6
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 76bc148abe806f63a711267cac3455fd_JaffaCakes118
Files
-
76bc148abe806f63a711267cac3455fd_JaffaCakes118.dll windows:4 windows x86 arch:x86
acd0f4621e91130aa90cdd34d55d38fc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
MessageBoxA
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 808B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 279B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 62B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ