Behavioral task
behavioral1
Sample
afe0aa1c4265fd8749c2c2acf8e7c049_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
afe0aa1c4265fd8749c2c2acf8e7c049_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
afe0aa1c4265fd8749c2c2acf8e7c049_JaffaCakes118
-
Size
60KB
-
MD5
afe0aa1c4265fd8749c2c2acf8e7c049
-
SHA1
bbb1529434e97c329b7bc17ec23060bd37faaaaa
-
SHA256
7d4bd80a7ad36b7b1b1b3398b7ba8896867d55a30c5049db4c2e7bd0403785d9
-
SHA512
bc158cfb92060353b543f875801af937e555a414d7b6968f0599986fd8d445df8deba541205092051d08f508eb48a3d8beb8896d4da2e6563e451a0b687116fb
-
SSDEEP
768:wpjn/YyyldukoMZTYMZGHQgyrvDQnPWwi/MOfxvCoKPWfU:G/bE3TZZYeLWPWU2YoK+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource afe0aa1c4265fd8749c2c2acf8e7c049_JaffaCakes118
Files
-
afe0aa1c4265fd8749c2c2acf8e7c049_JaffaCakes118.dll windows:4 windows x86 arch:x86
e6980e9ab17667e12586820e9a426d86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetSystemDirectoryA
Sleep
CreateThread
HeapAlloc
GetProcessHeap
VirtualAlloc
VirtualProtect
VirtualFree
GetProcAddress
LoadLibraryA
IsBadReadPtr
HeapFree
FreeLibrary
HeapReAlloc
GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
GetLastError
CloseHandle
ReadFile
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
InitializeCriticalSection
DeleteCriticalSection
ExitProcess
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
SetStdHandle
FlushFileBuffers
CreateFileA
GetCPInfo
GetACP
GetOEMCP
InterlockedDecrement
InterlockedIncrement
SetEndOfFile
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
FindWindowA
MessageBoxA
Sections
.text Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ