Behavioral task
behavioral1
Sample
8d24022bd0f0afd4c8552f5851c3397f_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8d24022bd0f0afd4c8552f5851c3397f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8d24022bd0f0afd4c8552f5851c3397f_JaffaCakes118
-
Size
72KB
-
MD5
8d24022bd0f0afd4c8552f5851c3397f
-
SHA1
7054a9d6462d5e1e6509eb6dc85ebde1ab64edb5
-
SHA256
cc4ae439fbf62c5db07158f6f70b9bdb7d0d18e86686b584231917061fedcfb9
-
SHA512
0f21e354785b25d5319d75f9f9b2172c7ef655ddb4d659dbd99eee0ad1f7170c875867db569bfc5ef90e106b72fe36e4106b4559434ff30d028d00c2a290c8f2
-
SSDEEP
1536:4o3s1cRKTuuOhiyFv8Dd189q/PJ+1DQuy8fUIZMTFIH:4oYcRKTuuOCX88/PMhZfzyGH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8d24022bd0f0afd4c8552f5851c3397f_JaffaCakes118
Files
-
8d24022bd0f0afd4c8552f5851c3397f_JaffaCakes118.dll windows:4 windows x86 arch:x86
97a6a8883f98c35dc370a926247f2fd1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord2764
ord4129
ord6648
ord537
ord926
ord924
ord922
ord535
ord858
ord6663
ord1168
ord860
ord4278
ord2818
ord939
ord6877
ord800
ord540
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
malloc
atoi
rand
srand
time
free
strtok
exit
strstr
printf
__CxxFrameHandler
kernel32
TerminateProcess
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
OpenProcess
GetTickCount
CreateThread
ExitThread
Sleep
ReadFile
GetSystemDirectoryA
GetStartupInfoA
CreatePipe
GetCurrentProcess
GetProcAddress
LoadLibraryA
GlobalMemoryStatus
Process32Next
CreateProcessA
CreateMutexA
GetLastError
ExitProcess
GetComputerNameA
GetVersionExA
CloseHandle
TerminateThread
lstrcpyA
user32
wsprintfA
MessageBoxA
ExitWindowsEx
advapi32
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
RegSetValueExA
RegDeleteValueA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
LookupPrivilegeValueA
shell32
ShellExecuteA
ws2_32
gethostbyname
sendto
socket
htons
inet_addr
inet_ntoa
setsockopt
WSASocketA
WSAStartup
gethostname
htonl
connect
send
closesocket
recv
WSAGetLastError
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ