Behavioral task
behavioral1
Sample
b7f1016a6cf28590217e17b30feacb77_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
b7f1016a6cf28590217e17b30feacb77_JaffaCakes118
-
Size
464KB
-
MD5
b7f1016a6cf28590217e17b30feacb77
-
SHA1
1390c3b9c2f49ad26ce733c0c00c3d5ad23a2752
-
SHA256
d40dc4c3e2f75d922a14e683e80500c427fd56bed6eee5919059c4ddaf89d756
-
SHA512
c0f6ba599f49a7929a746efc3765d75f242b67f51d15b7d4d10c8c125424fce54eebd3fc5d8a4d9a0a603a877db2d95d24d159480cf4afead1ddd8459891c550
-
SSDEEP
12288:zozz6aN0XjGYrZK2MNIyDTwo6Enm3t7Jzvh9G0B1YKItvsV:zozmLXJZKhNZvrClJzXdPKv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b7f1016a6cf28590217e17b30feacb77_JaffaCakes118
Files
-
b7f1016a6cf28590217e17b30feacb77_JaffaCakes118.dll windows:4 windows x86 arch:x86
7922769124dae29bbed02504896ce8f2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
IsBadReadPtr
GetCurrentProcess
MultiByteToWideChar
OutputDebugStringA
Sleep
lstrlenA
GetCommandLineA
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetSystemDirectoryA
GetLastError
GetModuleFileNameA
CreateProcessA
DeleteFileA
WinExec
GetCurrentProcessId
DisableThreadLibraryCalls
lstrcpynA
FlushFileBuffers
SetStdHandle
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
RtlUnwind
HeapAlloc
HeapReAlloc
HeapFree
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
InterlockedDecrement
InterlockedIncrement
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TerminateProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
SetUnhandledExceptionFilter
IsBadCodePtr
SetFilePointer
LCMapStringA
LCMapStringW
GetStringTypeA
user32
SetTimer
GetAsyncKeyState
wsprintfA
KillTimer
ws2_32
gethostbyname
send
closesocket
recv
connect
htons
socket
WSAStartup
Sections
.text Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 384KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ