Behavioral task
behavioral1
Sample
8d31d4668916c0a5a9c8a511077e6e3a_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
8d31d4668916c0a5a9c8a511077e6e3a_JaffaCakes118
-
Size
130KB
-
MD5
8d31d4668916c0a5a9c8a511077e6e3a
-
SHA1
7b3f1a733c417a2b3cb3b8255338af81137276cd
-
SHA256
97ef1a6d6a0a11d8df26303aea289c4cf22e680daf63a81a15b6742ae7748d04
-
SHA512
857c07918b27243fb721a0c152d843f981a7ac8e918f0f04d123e3f06b1a20c95070e8611f961849a21525a4294a2c2cb0e867cee0ac4f76f26e932d1f4f9b12
-
SSDEEP
3072:G6qt3K7muRSMX1JJP3U52vM5I+knjGy8FKn03CYTtBx:G6qt3FuEM7dO2E5IvnT2Cg
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
8d31d4668916c0a5a9c8a511077e6e3a_JaffaCakes118.dll windows:4 windows x86 arch:x86
6204e488f8d501cf46643b47a5f5bbe9
Code Sign
0f:05:05:ae:8b:e9:b8:bd:4e:fc:a0:60:c8:94:3d:2aCertificate
IssuerCN=1,1.2.840.113549.1.9.1=#130131,0.0=#130131Not Before31/12/2007, 16:00Not After31/12/2107, 16:00SubjectCN=1,1.2.840.113549.1.9.1=#130131,0.0=#1301310a:ab:fe:cf:b8:31:76:02:2b:b9:30:17:10:1c:9e:03:eb:eb:05:6aSigner
Actual PE Digest0a:ab:fe:cf:b8:31:76:02:2b:b9:30:17:10:1c:9e:03:eb:eb:05:6aDigest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
GetKeyboardType
advapi32
RegQueryValueExA
oleaut32
SysFreeString
ole32
CLSIDFromProgID
shell32
ShellExecuteA
wsock32
htons
wininet
DeleteUrlCacheEntry
shlwapi
PathFileExistsA
urlmon
URLDownloadToFileA
Sections
CODE Size: - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ