Behavioral task
behavioral1
Sample
f71cd5be421ec7e96637232b00858edc_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
f71cd5be421ec7e96637232b00858edc_JaffaCakes118
-
Size
290KB
-
MD5
f71cd5be421ec7e96637232b00858edc
-
SHA1
ee30c28f168b810544a6e154183f4b3b9ebffcd4
-
SHA256
48c9b49f012e9953319199f585dc439e5c5eab8ab1a9299a3718b5a05c15859e
-
SHA512
0a6b7e7af9518fd88eda18784d7a6670a923b80d691370e16f21b4737fd4874f794ab0478aa866a54494ffd7438e79e472935889acad998738663c4b16ef0bbb
-
SSDEEP
6144:keArE6RAK4GD6wJKgWMs9WVy9KkyCemB15iEle7ZOUfZCIFL:zAMeDhJPIC12G7MUfZCA
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f71cd5be421ec7e96637232b00858edc_JaffaCakes118
Files
-
f71cd5be421ec7e96637232b00858edc_JaffaCakes118.dll windows:5 windows x86 arch:x86
7f3859f99c71c2ced42ad78d01ed0352
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Sections
.text Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 219KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 287KB - Virtual size: 287KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ