??��??���㨦
Behavioral task
behavioral1
Sample
a884fc68325aeef217a4a2bcc841a634_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
a884fc68325aeef217a4a2bcc841a634_JaffaCakes118
-
Size
912KB
-
MD5
a884fc68325aeef217a4a2bcc841a634
-
SHA1
cd8cc06a6c804e0ae3c78db844f1015ea0977c7e
-
SHA256
d8db4030da14651dd9b1d107d6b4f068be008d6cd97cc8e34fa214349a5740b7
-
SHA512
1f2e7b9f37dd49e167ad85d58f9867102f6c14fc10d9f8c99154d2d3a1ecfa0e40b3a73e374cd332a26d38e0f3f0e7ac9d67d6469c8130bd0da00f6b269c5e81
-
SSDEEP
24576:D1OVUwP1weSO2v/JWHDgBTRH3eamZdGdH1qzCLpi:D1OVpyJfWUvSExUu8
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a884fc68325aeef217a4a2bcc841a634_JaffaCakes118
Files
-
a884fc68325aeef217a4a2bcc841a634_JaffaCakes118.dll windows:4 windows x86 arch:x86
6809285ef9c86827ffdb02bee9858bf9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
winmm
waveOutUnprepareHeader
ws2_32
getpeername
kernel32
HeapCreate
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RemovePropA
MessageBoxA
gdi32
GetStockObject
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyA
shell32
SHGetSpecialFolderPathA
ole32
OleUninitialize
oleaut32
UnRegisterTypeLi
comctl32
ord17
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 521KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 207KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 552KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 896KB - Virtual size: 894KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ