Hello
Behavioral task
behavioral1
Sample
d1bd6877a210d11d1b253f7ff77aaa06_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
d1bd6877a210d11d1b253f7ff77aaa06_JaffaCakes118
-
Size
364KB
-
MD5
d1bd6877a210d11d1b253f7ff77aaa06
-
SHA1
e3eee4fa64475e9a8841d37d8d3ff07e8a4cc970
-
SHA256
4e73591aae6c952e9f14093832ecfea1cfd56cf4858f4af54adf07d3406d2cf7
-
SHA512
1400d81afc747a4487b9328360d347d5e0f2a28c48ef3c7cbbc9c8aad528cee5b7eb4a33dd23600ff00edb44fc7347d93eb046375fc20e7368324d341b2e4163
-
SSDEEP
6144:cQyFGQgeVVC53kXV/WHfP7F/uNerdrru+TnNyiS42ggL2JVaKMxR2nSAC1zg9iMh:cfFX3CFAdWX7ZQW2mD0gguVaKURfh+DJ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d1bd6877a210d11d1b253f7ff77aaa06_JaffaCakes118
Files
-
d1bd6877a210d11d1b253f7ff77aaa06_JaffaCakes118.dll windows:4 windows x86 arch:x86
6517a02cbec7387e80ae28ee9b3e0726
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersion
GetVersionExA
GetSystemDirectoryA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetNextDlgTabItem
shlwapi
PathFileExistsA
gdi32
GetObjectA
winspool.drv
DocumentPropertiesA
advapi32
RegSetValueExA
comctl32
ord17
Exports
Exports
Sections
.text Size: - Virtual size: 246KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 169KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ