���㿴��
Behavioral task
behavioral1
Sample
d4ab9088aae7393d49e4f97d96540b7a_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
d4ab9088aae7393d49e4f97d96540b7a_JaffaCakes118
-
Size
480KB
-
MD5
d4ab9088aae7393d49e4f97d96540b7a
-
SHA1
3ddbb2278841e4a0daf6ef80823fc45dbb063f49
-
SHA256
b979928b598bcbeb71f7c92823129d7dfb03c8d8ba4f3fa6bb40002c7c7ed745
-
SHA512
85064ef2f896d7cf7290d4ac337197f5373d51a7cb76e91a1233bd159667609ff08e05bd39ebd7af752dabacd6de5fba67e65563a86b98257d485f3594ef0e73
-
SSDEEP
6144:VG6vyqiXaG817YRxPuqARloO7fAFL27CicbhdFtSU+giv/ayjv3UmTL7hHhYHIPm:V3EKJ7I2qGoOstFegxyjThK0
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d4ab9088aae7393d49e4f97d96540b7a_JaffaCakes118
Files
-
d4ab9088aae7393d49e4f97d96540b7a_JaffaCakes118.dll windows:4 windows x86 arch:x86
0bcfe80fbc0e957c5027f62e7e11032e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
winmm
midiStreamRestart
ws2_32
WSAAsyncSelect
kernel32
MultiByteToWideChar
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
EnumDisplaySettingsA
gdi32
GetClipBox
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
LoadTypeLi
comctl32
ord17
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 510KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 464KB - Virtual size: 462KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ