Behavioral task
behavioral1
Sample
dc1d917751206c60ea4ba1f01622ff73_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
dc1d917751206c60ea4ba1f01622ff73_JaffaCakes118
-
Size
444KB
-
MD5
dc1d917751206c60ea4ba1f01622ff73
-
SHA1
3ed5f5397935734e8738e64b89aadba23e924eeb
-
SHA256
19833037754029f8df9574f83cc64c0c8d0e370f3a26691e730748fef68b6ab0
-
SHA512
2b934c83f30b9734b97c6491268684eec34301d84e4536e63a8d4b8fa5146b741769b8a456a3e896ebe1f420eb4e9b5e6b1b73f4c7fd6d76f7a99d93ee2baf74
-
SSDEEP
12288:+3pBpheS0oBg0eOh66V/7C7NrVhd0OjbIL:mBaRe17C7THjje
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc1d917751206c60ea4ba1f01622ff73_JaffaCakes118
Files
-
dc1d917751206c60ea4ba1f01622ff73_JaffaCakes118.dll windows:4 windows x86 arch:x86
40dfa179670cf7eb46606a170803cff6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ReadFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowLongA
ws2_32
htonl
msvcrt
_snprintf
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 930B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 361KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 432KB - Virtual size: 429KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ