Behavioral task
behavioral1
Sample
dd4b2f7f4b6902f7903d04aa16a7e8e4_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
dd4b2f7f4b6902f7903d04aa16a7e8e4_JaffaCakes118
-
Size
739KB
-
MD5
dd4b2f7f4b6902f7903d04aa16a7e8e4
-
SHA1
be4b48239bcb24026d19c3c158e998dbab96af33
-
SHA256
4138fcb127aca90302fd75d9ff0a60f0e91619f1353bd64eab803d24bcf5eecf
-
SHA512
7c4ae4cfc9327c9f68b3d03555ec940d3118226bb341a1ac4f901be19704c0ba4fc7b0ea4ac8b1cc3a5cc3ca20641d3db3afa53a78c57efd2a88e47faa497ab3
-
SSDEEP
12288:++FFbH8OnYPPfcY2YJA9pG/g/Oe7l6x/j8BgaJQ9eGT7Cf9Vq7z3i47amI+WJK/:++FFbH8HPPfcY2YcPOV6g8Q4GCfmz3iY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd4b2f7f4b6902f7903d04aa16a7e8e4_JaffaCakes118
Files
-
dd4b2f7f4b6902f7903d04aa16a7e8e4_JaffaCakes118.exe windows:5 windows x86 arch:x86
5100cddc54c5df1fc6b6ca2b1186b94c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineA
GetStartupInfoA
HeapAlloc
HeapFree
RaiseException
RtlUnwind
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
Sleep
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetFileTime
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GetFileSizeEx
GetFileAttributesA
FileTimeToLocalFileTime
SetErrorMode
GetOEMCP
GetCPInfo
InterlockedIncrement
GetModuleHandleW
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
FileTimeToSystemTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GlobalFlags
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
GetThreadLocale
WritePrivateProfileStringA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
lstrcmpA
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
lstrcmpW
GetVersionExA
FormatMessageA
LocalFree
lstrlenA
FreeLibrary
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
GetModuleFileNameA
SizeofResource
WideCharToMultiByte
MultiByteToWideChar
GlobalLock
GlobalUnlock
MulDiv
GetModuleHandleA
SetLastError
GetLastError
GetSystemTime
GetTempPathA
GetSystemDirectoryA
WriteFile
CreateFileA
CreateThread
CloseHandle
WinExec
LockResource
GetTickCount
LoadResource
FindResourceA
ExitProcess
GetCurrentDirectoryA
LoadLibraryA
GetProcAddress
GlobalFree
HeapCreate
GlobalAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RegisterClipboardFormatA
PostThreadMessageA
WaitMessage
CharUpperA
GetMessageA
TranslateMessage
ValidateRect
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
SetActiveWindow
DispatchMessageA
GetDlgItem
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageA
SetMenu
SetForegroundWindow
IsWindowVisible
UpdateWindow
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
CopyRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
GetMenuItemID
GetMenuItemCount
GetSubMenu
UnhookWindowsHookEx
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
GetKeyState
SetWindowPos
IsWindowEnabled
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
ScreenToClient
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
SetRect
IsRectEmpty
MessageBoxA
IsIconic
CopyAcceleratorTableA
CharNextA
DestroyMenu
GetTopWindow
UnregisterClassA
LoadIconA
DrawIcon
GetSystemMetrics
RegisterHotKey
SetCursor
SetTimer
GetWindowRect
FillRect
SetCapture
KillTimer
DrawIconEx
GetParent
TrackMouseEvent
WindowFromPoint
SendMessageA
PtInRect
CreateIconIndirect
GetIconInfo
GetDC
ShowCursor
InflateRect
InvalidateRect
ReleaseDC
GetSysColor
GetCursorPos
GetSysColorBrush
IsWindow
ReleaseCapture
MapWindowPoints
EnableWindow
LoadCursorA
DestroyIcon
DrawTextA
GetClientRect
GrayStringA
DrawTextExA
TabbedTextOutA
gdi32
ExtSelectClipRgn
CreateBitmap
GetStockObject
GetDeviceCaps
ScaleWindowExtEx
CreateRectRgnIndirect
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetWindowExtEx
GetViewportExtEx
GetObjectA
TextOutA
MoveToEx
LineTo
GetClipBox
SetMapMode
SetTextColor
SetBkMode
SetBkColor
RestoreDC
SaveDC
GetTextExtentPoint32A
CreateFontA
GetDIBits
Rectangle
SetDIBits
CreatePen
CreateSolidBrush
BitBlt
DeleteDC
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
PtVisible
SetBoundsRect
Escape
RectVisible
ExtTextOutA
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
ClosePrinter
OpenPrinterA
advapi32
RegOpenKeyA
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegCloseKey
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA
oledlg
ord8
ole32
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoTaskMemFree
oleaut32
SysAllocString
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
SysAllocStringByteLen
SysFreeString
SysStringLen
urlmon
URLDownloadToFileA
ws2_32
WSAGetLastError
WSASetLastError
connect
bind
recvfrom
WSAAsyncSelect
send
recv
inet_addr
htons
htonl
gethostbyname
select
socket
WSAStartup
inet_ntoa
accept
closesocket
sendto
ntohs
WSACleanup
Sections
.text Size: - Virtual size: 217KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 486KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 731KB - Virtual size: 730KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ