ServiceMain
Behavioral task
behavioral1
Sample
b4f4301c447c3e8ca5c11c35c7094794_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
b4f4301c447c3e8ca5c11c35c7094794_JaffaCakes118
-
Size
82KB
-
MD5
b4f4301c447c3e8ca5c11c35c7094794
-
SHA1
ede6623ffb79358179cf113cca0904805ad00050
-
SHA256
27e71e08e97af9f0984a3e8b4ea4fd4fecff70f8464d52a8bae36fed24399ccc
-
SHA512
a35b87d060653ac985379c08ad8025e4031bcde8b53cb774d27adca93cf0075731e731da3598a9a3d05020f25eab77a32e00031a8cebefad4a29d20548f0199b
-
SSDEEP
1536:BNF5uzaj95Ha5BAedFnToIfopCrGAGLFhZyBC0kOnA:BD5YBAedtTBfopCrGp2C03n
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b4f4301c447c3e8ca5c11c35c7094794_JaffaCakes118
Files
-
b4f4301c447c3e8ca5c11c35c7094794_JaffaCakes118.dll windows:4 windows x86 arch:x86
2f799229b4913650dcbc6f4693b8c90b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
Process32Next
Module32First
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
WaitForSingleObject
CreateThread
MoveFileExA
lstrcpyA
MoveFileA
CopyFileA
DeleteFileA
GetFileSize
CreateFileA
WriteFile
GlobalMemoryStatus
GetVersionExA
GetComputerNameA
GetTickCount
HeapAlloc
GetProcessHeap
GetCurrentProcessId
GetCurrentThreadId
lstrcatA
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
ResumeThread
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLastError
FindNextFileA
FindClose
GetDriveTypeA
CreatePipe
GetStartupInfoA
GetSystemDirectoryA
CreateProcessA
CloseHandle
Sleep
GetWindowsDirectoryA
ReadFile
user32
CloseWindowStation
CloseDesktop
GetThreadDesktop
OpenWindowStationA
SetProcessWindowStation
OpenDesktopA
SetThreadDesktop
GetSystemMetrics
wsprintfA
ExitWindowsEx
GetProcessWindowStation
gdi32
DeleteObject
DeleteDC
GetDIBits
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
advapi32
OpenServiceA
ChangeServiceConfigA
QueryServiceStatus
ControlService
CloseServiceHandle
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenSCManagerA
shell32
ShellExecuteA
SHGetFileInfoA
msvcrt
__CxxFrameHandler
_ftol
_strlwr
rand
malloc
__dllonexit
_onexit
free
_initterm
_adjust_fdiv
??3@YAXPAX@Z
strstr
strcspn
atoi
sprintf
strncpy
??2@YAPAXI@Z
ws2_32
send
inet_addr
shutdown
recv
closesocket
connect
socket
htons
WSAStartup
setsockopt
sendto
htonl
WSASocketA
gethostbyname
Exports
Exports
Sections
.text Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ