Behavioral task
behavioral1
Sample
ea5c2beb8019b6a6c60070b219cb4fa5_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ea5c2beb8019b6a6c60070b219cb4fa5_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ea5c2beb8019b6a6c60070b219cb4fa5_JaffaCakes118
-
Size
232KB
-
MD5
ea5c2beb8019b6a6c60070b219cb4fa5
-
SHA1
4ee96778bc8f9cadbfdfda5f272f440046856719
-
SHA256
c76e9c0b9af3655fd13eb4f8a01acaeddf398adc2f97b0e2aab3da73e5571436
-
SHA512
a26205cdb65bad62bfc22c35640feba9db5eab75f0d4e927ded0e545860ca3d3a9a914edb0321983398ca34a2c28b91339f06241675d1c138c3798bd403357d9
-
SSDEEP
1536:QXrcgzsJjuagosBucVhCfHxjs3a54jEdU9VYKufCFG7XAjBEyeT9gWYk9YT0SZoj:QXrtzshup/VhCfHxjs3NZVGYHojd
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea5c2beb8019b6a6c60070b219cb4fa5_JaffaCakes118
Files
-
ea5c2beb8019b6a6c60070b219cb4fa5_JaffaCakes118.dll windows:4 windows x86 arch:x86
3bd96a1070526f903160feac70771d4c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
GetProcAddress
GetModuleHandleA
ExitProcess
CreateThread
CompareStringW
CompareStringA
CloseHandle
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
IsBadWritePtr
IsBadReadPtr
HeapValidate
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
SetConsoleCtrlHandler
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
UnhandledExceptionFilter
HeapAlloc
HeapReAlloc
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetFilePointer
RtlUnwind
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetVersionExA
SetStdHandle
FlushFileBuffers
GetTimeZoneInformation
GetLocaleInfoW
SetEnvironmentVariableA
user32
MessageBoxA
GetAsyncKeyState
Sections
.text Size: 176KB - Virtual size: 172KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ