Behavioral task
behavioral1
Sample
dadbdb83f51f1a958f6e514914981bab_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
dadbdb83f51f1a958f6e514914981bab_JaffaCakes118
-
Size
235KB
-
MD5
dadbdb83f51f1a958f6e514914981bab
-
SHA1
8805b3e3f0c1bae91b74e0631364e25380a733f1
-
SHA256
01a982ae061ef467f73c34ed0ce68b8669d6a7ad0a0cb74b5aa845cc3f012aa9
-
SHA512
2563f4f49262854565f1cee78fd110eaf0db2421abe3d691e78de3b094381f24b3ccd3a7b194cc27f4826b2a2c5b845a78dafd24b4e9671d79bdb4143667e7e1
-
SSDEEP
6144:VBbA8WDv5DpJNmhu+gQZ8lrECupONY2X846W0iDFJGHmGjJ7wU:/bA8WDBpJUhHgQetECxNYD+bOu
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dadbdb83f51f1a958f6e514914981bab_JaffaCakes118
Files
-
dadbdb83f51f1a958f6e514914981bab_JaffaCakes118.dll windows:5 windows x86 arch:x86
7584a2c080235cc7aa8e2edd86e88450
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
QueryPerformanceCounter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetRect
shell32
ShellExecuteA
msvcr90
_except_handler4_common
wininet
InternetCloseHandle
gdi32
CreateFontIndirectA
advapi32
RegOpenKeyA
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 233KB - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ