Behavioral task
behavioral1
Sample
df694849d6d0de776543ff0707d8f7e3_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
df694849d6d0de776543ff0707d8f7e3_JaffaCakes118
-
Size
600KB
-
MD5
df694849d6d0de776543ff0707d8f7e3
-
SHA1
a814cceb56524dac9bad02c4d87acd6969f16ee0
-
SHA256
d27388b6efe85836765d459502db251e9138561fea66df794353e2eab271f2b5
-
SHA512
e9cde4c5a68e6c8b7431cf3941a2358c4feae3696d591d1c6332b0461bf3144345059a301259db76d0204e57ed5833af16e294224fa96fbb1223a01cc5378eef
-
SSDEEP
12288:dpF3fvqY6WOGS1cc0FVC9EGLUT4zcj2ff6/H5oabiWmDf:dpFvvq16tcl9VYqcj26xXiW
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df694849d6d0de776543ff0707d8f7e3_JaffaCakes118
Files
-
df694849d6d0de776543ff0707d8f7e3_JaffaCakes118.dll windows:4 windows x86 arch:x86
4c4333dda326eeb409848eb40014f47d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LCMapStringA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
GetModuleFileNameA
ExitProcess
user32
SetScrollRange
MessageBoxA
gdi32
DeleteDC
comdlg32
GetSaveFileNameA
winspool.drv
OpenPrinterA
advapi32
AdjustTokenPrivileges
shell32
SHGetFileInfoA
comctl32
ord17
shlwapi
PathFindExtensionA
ole32
CreateBindCtx
oleaut32
SysStringByteLen
Sections
.text Size: - Virtual size: 194KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 428KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 588KB - Virtual size: 584KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ