SetHook
Behavioral task
behavioral1
Sample
86eeb8cb225b70f6b9336424a5b27962_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
86eeb8cb225b70f6b9336424a5b27962_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
86eeb8cb225b70f6b9336424a5b27962_JaffaCakes118
-
Size
112KB
-
MD5
86eeb8cb225b70f6b9336424a5b27962
-
SHA1
703655b3db1dbe1e5404b364fcfb22d499cc5d4e
-
SHA256
aea16be83f025eb4c8aa3aedf9d41aaf60006ac49897d617bfb3eacb97880ba0
-
SHA512
1d89e1e718ea12e0d183b0dfc694bd0c799713fdcd94d63b4e2e8f61d139831727ad879be03c746973f70afc7a56e3e5ed16c7c9089a8a4ef1c75a8efe3a62c7
-
SSDEEP
1536:PZfRE40WFeS35OlyC2zk1MxTRNLa8jmCGoI1RRzARZzP/o4XpvY:PZfiUFeSJOl4Aw5fjGoI5qdA8v
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 86eeb8cb225b70f6b9336424a5b27962_JaffaCakes118
Files
-
86eeb8cb225b70f6b9336424a5b27962_JaffaCakes118.dll windows:4 windows x86 arch:x86
e769a63574d144030ed39a63003109d7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
GetModuleHandleW
GetCurrentProcessId
LoadLibraryW
CloseHandle
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
LCMapStringA
ReadFile
SetStdHandle
LoadLibraryA
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
IsBadCodePtr
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
RtlUnwind
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
HeapFree
GetCommandLineA
GetVersion
RaiseException
ExitProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
TerminateProcess
GetCurrentProcess
HeapSize
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
SetUnhandledExceptionFilter
SetFilePointer
FlushFileBuffers
GetCPInfo
IsBadReadPtr
user32
PostMessageW
SetWindowsHookExW
GetWindowThreadProcessId
CallNextHookEx
Exports
Exports
Sections
.text Size: 52KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sharedda Size: 4KB - Virtual size: 524B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ