Behavioral task
behavioral1
Sample
e205239aa416ead4d4651920967648bc_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e205239aa416ead4d4651920967648bc_JaffaCakes118.dll
Resource
win10v2004-20240910-en
General
-
Target
e205239aa416ead4d4651920967648bc_JaffaCakes118
-
Size
130KB
-
MD5
e205239aa416ead4d4651920967648bc
-
SHA1
d6f3e8562669c7fad9b28fb05ba66fead0abb8a7
-
SHA256
a0cb8a4a6705904e5ffda5a4afdf65138d9d1f1656a68dfc39c6f9d5bbd71876
-
SHA512
121b78c1b7900054252f68415f71a85266fd1a3157252750215b12fc6bac97a04ec528f1e84928cee6e520081573d5aca39edeceb027304b48bc2ca36abec08c
-
SSDEEP
3072:yNUXtAgzkCMD5vPvEzB9FrWQ4CQbYRvqanxhWqgoQM92zcW2fd:yNYfCdYEsqExoqgX/cW
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e205239aa416ead4d4651920967648bc_JaffaCakes118
Files
-
e205239aa416ead4d4651920967648bc_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ