Behavioral task
behavioral1
Sample
b9e2320997e33ff7a47e9782c459ed8c_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
b9e2320997e33ff7a47e9782c459ed8c_JaffaCakes118
-
Size
1.4MB
-
MD5
b9e2320997e33ff7a47e9782c459ed8c
-
SHA1
8a3f147c9b3c1a8777914f819f1d96a93a74f069
-
SHA256
ecbba6f7bd700eadab863e3d775827c030c8e65d2de52ec413c9b0c58efcff7a
-
SHA512
6ecd3db232b654d75081813679383392f3adff1fa8609062356af3ff0efd90e85f3442fd462eb7c4ab7d2fa9ab7642b8a28bcb711ec31bf0221c59ace4f5c567
-
SSDEEP
24576:lgu4VnL1b9ldaHHzw8praGBvmMO9w02+HgSKInoL4S/H3NtjTYmx4iSHSD:aJhb9czw8pIx2iK0B2XNpcmx4iOS
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b9e2320997e33ff7a47e9782c459ed8c_JaffaCakes118
Files
-
b9e2320997e33ff7a47e9782c459ed8c_JaffaCakes118.dll windows:4 windows x86 arch:x86
e24751017be5ffc55546c55eae6bdae1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
select
ntdll
wcscmp
kernel32
LeaveCriticalSection
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Sections
.text Size: - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ