Behavioral task
behavioral1
Sample
864683dce874f22490b7023fbded3820_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
864683dce874f22490b7023fbded3820_JaffaCakes118
-
Size
121KB
-
MD5
864683dce874f22490b7023fbded3820
-
SHA1
591f73f3e9a6e446090c247b95c37ffd96350836
-
SHA256
348b827ae9443486f1986a368cc4aac657246ce2307e20620cfeeed55267ec6a
-
SHA512
3c7d7a636d2f3f96af59cc7857cfa6a935d7513f086863c3224078e6b14bf7352430cd11dedc9a6ab9a918f3ef37c6bfe01793c81fb43030d6e71a56d3c06788
-
SSDEEP
1536:JI7EQ3FVGbfOcn0F25z864UvgZ6r0VXsbQlbLa3vZodEEc6Mp:a7fbG6W0FaI3UKvlbshIcx
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
864683dce874f22490b7023fbded3820_JaffaCakes118.dll windows:4 windows x86 arch:x86
Code Sign
e5:1c:62:71:23:a1:e8:cd:e2:22:45:07:de:fd:ff:2b:cf:a4:34:6fSigner
Actual PE Digeste5:1c:62:71:23:a1:e8:cd:e2:22:45:07:de:fd:ff:2b:cf:a4:34:6fDigest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.tttt Size: 66KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdddd Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dddd Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
woria Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
MABIDE Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: 17KB - Virtual size: 17KB
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ