Behavioral task
behavioral1
Sample
da099d95a836a5e2ff5e33ad11bbf4cc_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
da099d95a836a5e2ff5e33ad11bbf4cc_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
da099d95a836a5e2ff5e33ad11bbf4cc_JaffaCakes118
-
Size
72KB
-
MD5
da099d95a836a5e2ff5e33ad11bbf4cc
-
SHA1
1380f897357812defbcdfdb14da52171346cc6b6
-
SHA256
e26e3766e4572b96d3e2a59c566b0a610090cee9366fbaec7ac6996dbd8afd8f
-
SHA512
1ffa175c026ad2655a18c2797934948def6adc249a6004f541101edb652a6e49b8edfc141e14ad836272bf07d13f0daa24672864c7890e123f7bced750a2f3df
-
SSDEEP
1536:Pjn4M7+g3b9aT6cuEjF4IUHGx14CWMIH:r4M7Hb8TjZEo4CWhH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource da099d95a836a5e2ff5e33ad11bbf4cc_JaffaCakes118
Files
-
da099d95a836a5e2ff5e33ad11bbf4cc_JaffaCakes118.dll windows:4 windows x86 arch:x86
650eb780479df3c80a3ac2ee477c5a0d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord2915
ord2764
ord4129
ord6648
ord537
ord926
ord924
ord922
ord535
ord858
ord6663
ord860
ord4278
ord2818
ord1168
ord939
ord6877
ord800
ord540
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
malloc
time
__CxxFrameHandler
atoi
rand
free
strtok
exit
strstr
printf
srand
kernel32
Process32Next
GetTickCount
CreateThread
ExitThread
Sleep
lstrcmpiA
CloseHandle
GetVersionExA
GetComputerNameA
ExitProcess
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
CreateProcessA
GetProcAddress
LoadLibraryA
GetCurrentProcess
GetSystemDirectoryA
TerminateThread
CreateMutexA
GetLastError
lstrcpyA
user32
ExitWindowsEx
MessageBoxA
wsprintfA
advapi32
OpenProcessToken
LookupPrivilegeValueA
RegCloseKey
RegSetValueExA
RegDeleteValueA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
AdjustTokenPrivileges
shell32
ShellExecuteA
ws2_32
gethostbyname
sendto
socket
htons
inet_addr
inet_ntoa
setsockopt
WSASocketA
WSAStartup
gethostname
htonl
connect
send
closesocket
recv
WSAGetLastError
WSACleanup
__WSAFDIsSet
select
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 888B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ