Behavioral task
behavioral1
Sample
c233f988d1de856c7ce99d719d6aec03_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
c233f988d1de856c7ce99d719d6aec03_JaffaCakes118
-
Size
192KB
-
MD5
c233f988d1de856c7ce99d719d6aec03
-
SHA1
a915bb2955863618f0e455c19318d8ba79604876
-
SHA256
dc58782ae708381bc6367cacf790be140973ce3bbfff4339d6d0a93bf5573006
-
SHA512
4dd914a77827666fce8c88c3bb1816b5446c865f7f7be84815327a5901918eb31f9461a2938d1f5d99dc214e877a3b8f2efadc0247d950b971b36876242f7640
-
SSDEEP
3072:h6BlZX3bj1tgQraGyN5iu17IOF3gSt+IztYtbsLGlQJuZS7XV1KLdXS6RA3:UX3bjDxy3/DgEql6KP
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c233f988d1de856c7ce99d719d6aec03_JaffaCakes118
Files
-
c233f988d1de856c7ce99d719d6aec03_JaffaCakes118.dll windows:4 windows x86 arch:x86
b1eeb29cd4df809d5f7d4b3552cfaec7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FlushFileBuffers
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
advapi32
RegQueryValueExA
Sections
.text Size: - Virtual size: 149KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 184KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ