interfaceDll
Behavioral task
behavioral1
Sample
89c9f26f2c0b1330023d67f8a731ac2e_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
89c9f26f2c0b1330023d67f8a731ac2e_JaffaCakes118
-
Size
3.2MB
-
MD5
89c9f26f2c0b1330023d67f8a731ac2e
-
SHA1
0649c525d95662d71e7d9021b7ce98e8e4a4312d
-
SHA256
a73d730d15935e975364bc47bfc9272d0d3b10bfd31e75fa6400ddccbe10f223
-
SHA512
b7976eb20c888672c8cca50adb93ba61315f2c3e24ba398264beaf874395ff541466e30bd41bad74eeba92641ae422f6eaf1e702b43cc7ef6b5762eb40247283
-
SSDEEP
98304:ceD9zUWv5kL3tOke0VtZi8bXYUmDn6yC:fF92bB8P/DrC
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 89c9f26f2c0b1330023d67f8a731ac2e_JaffaCakes118
Files
-
89c9f26f2c0b1330023d67f8a731ac2e_JaffaCakes118.dll windows:6 windows x86 arch:x86
a8bcd9c8b44f08619bfda28f0606e84d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
winmm
PlaySoundA
kernel32
GetVersionExA
GetVersion
LoadLibraryExA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
gdi32
GetStockObject
comdlg32
GetOpenFileNameA
advapi32
RegOpenKeyExA
shell32
SHCreateDirectoryExW
shlwapi
PathFindFileNameA
ole32
RegisterDragDrop
gdiplus
GdipSetCompositingQuality
oleaut32
SafeArrayUnaccessData
imm32
ImmAssociateContext
riched20
ord4
oleacc
ObjectFromLresult
wininet
InternetGetCookieA
oledlg
ord8
winspool.drv
OpenPrinterA
comctl32
ord17
Exports
Exports
Sections
.text Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 629KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 408B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE