ServiceMain
Behavioral task
behavioral1
Sample
d1009db0f804e89a8c2f547b33a407eb_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d1009db0f804e89a8c2f547b33a407eb_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d1009db0f804e89a8c2f547b33a407eb_JaffaCakes118
-
Size
68KB
-
MD5
d1009db0f804e89a8c2f547b33a407eb
-
SHA1
48dfb8b69b017a1a0fbe14b3cca12298b1552f62
-
SHA256
ed9069ea26ac7f8fd76deca462535b0f741c7c0b0ca33cf36d563564e5291d4c
-
SHA512
aa4b1e42add8870fdd64068637a83ffea542db69b9a19093f2f1646e9faaa980fcb3137556a0b6fa98b31ec6bb970129dbed1ed85f89b9cc7049b938b14f690e
-
SSDEEP
1536:62wuENKJc0zfS1fuksFnToIfsPNq5KbAVFD5NK5yM6:MuEN4+1fukstTBfsPNq5fLDAyM
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d1009db0f804e89a8c2f547b33a407eb_JaffaCakes118
Files
-
d1009db0f804e89a8c2f547b33a407eb_JaffaCakes118.dll windows:4 windows x86 arch:x86
5183ecce1d043bfefe8ec7b802f54871
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FreeLibrary
GetProcAddress
LoadLibraryA
Process32Next
Module32First
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
lstrcpyA
WaitForSingleObject
CreateThread
OutputDebugStringA
lstrcpynA
GetCurrentProcess
GetWindowsDirectoryA
GetTickCount
GetFileSize
CreateFileA
WriteFile
FreeConsole
GlobalMemoryStatus
GetVersionExA
GetComputerNameA
InterlockedExchange
HeapAlloc
GetProcessHeap
GetCurrentProcessId
GetCurrentThreadId
MoveFileA
CopyFileA
DeleteFileA
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLastError
FindNextFileA
FindClose
GetLogicalDriveStringsA
GetDriveTypeA
CreatePipe
CloseHandle
GetStartupInfoA
GetSystemDirectoryA
CreateProcessA
ReadFile
MoveFileExA
Sleep
user32
CloseWindowStation
CloseDesktop
GetProcessWindowStation
GetThreadDesktop
SetProcessWindowStation
OpenDesktopA
SetThreadDesktop
GetSystemMetrics
IsWindow
SendMessageA
CloseWindow
CreateWindowExA
mouse_event
ExitWindowsEx
keybd_event
OpenWindowStationA
wsprintfA
GetDesktopWindow
SetCursorPos
gdi32
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
GetDIBits
DeleteDC
DeleteObject
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenProcessToken
shell32
ShellExecuteA
SHGetFileInfoA
msvcrt
??2@YAPAXI@Z
atoi
strcspn
strstr
_strlwr
__CxxFrameHandler
_ftol
wcstombs
rand
malloc
__dllonexit
_onexit
free
_initterm
_adjust_fdiv
??3@YAXPAX@Z
sprintf
strncpy
strncat
ws2_32
WSAStartup
shutdown
closesocket
connect
socket
htons
setsockopt
sendto
htonl
WSASocketA
inet_addr
gethostbyname
recv
send
avicap32
capCreateCaptureWindowA
capGetDriverDescriptionA
Exports
Exports
Sections
.text Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ