Behavioral task
behavioral1
Sample
fdbd91df4676d14c4a350ee9b3c8f535_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fdbd91df4676d14c4a350ee9b3c8f535_JaffaCakes118.dll
Resource
win10v2004-20240910-en
General
-
Target
fdbd91df4676d14c4a350ee9b3c8f535_JaffaCakes118
-
Size
54KB
-
MD5
fdbd91df4676d14c4a350ee9b3c8f535
-
SHA1
2403062fe23d3ba819b13a4929d79bd5e922c8fb
-
SHA256
4c5eff228eb64180fbf44f0294179802f92652653570f9265ff4c4c58ed780e2
-
SHA512
fe0bf016e9fe88e1438d18d0fa1585c447ee4337514efa200825cc259338f3d2103c720bafa485f9cb32f591774ed19660fba30546d613332e75044465340e37
-
SSDEEP
1536:DJCNg/jP2hWHDUeAofyXQtA2mUzMykKSYiGX+0uRPkFI:DF7fyXuzMyUYiGu0umq
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fdbd91df4676d14c4a350ee9b3c8f535_JaffaCakes118
Files
-
fdbd91df4676d14c4a350ee9b3c8f535_JaffaCakes118.dll windows:4 windows x86 arch:x86
6433fc334c4f4917955f0e35c0c3b4b6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
GetFileSize
ReadFile
CreateFileA
lstrcpynA
DeleteFileA
GetTempPathA
MultiByteToWideChar
GlobalFree
GlobalUnlock
WriteFile
GlobalLock
GlobalAlloc
Process32Next
GetTickCount
CreateToolhelp32Snapshot
GetModuleHandleA
VirtualAlloc
GetPrivateProfileStringA
CreateThread
WritePrivateProfileStringA
GetSystemTime
WideCharToMultiByte
IsBadReadPtr
SetFilePointer
GetLastError
CreateMutexA
GetCurrentProcessId
GetModuleFileNameA
lstrlenA
lstrcmpiA
lstrcmpA
Sleep
ExitProcess
VirtualProtect
lstrcpyA
GetSystemDirectoryA
lstrcatA
LoadLibraryA
GetProcAddress
FreeLibrary
Process32First
OutputDebugStringA
user32
EnumWindows
ReleaseDC
GetDC
IsRectEmpty
GetWindowThreadProcessId
FindWindowExA
FindWindowA
PrintWindow
GetWindowInfo
SetForegroundWindow
ShowWindow
GetActiveWindow
IsIconic
GetWindowTextA
GetSystemMetrics
IsWindowVisible
gdi32
CreateCompatibleBitmap
CreateCompatibleDC
GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetObjectA
DeleteDC
GetDeviceCaps
CreateDCA
DeleteObject
BitBlt
SelectObject
wininet
HttpEndRequestA
HttpSendRequestExA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetCloseHandle
ws2_32
shutdown
inet_ntoa
gethostbyname
gdiplus
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCloneImage
GdipDisposeImage
GdipFree
GdiplusShutdown
GdipAlloc
GdipLoadImageFromFile
GdipSaveImageToFile
GdiplusStartup
msvcrt
free
atoi
??3@YAXPAX@Z
wcscmp
??2@YAPAXI@Z
strstr
memmove
strrchr
sprintf
_except_handler3
_local_unwind2
malloc
shlwapi
StrChrW
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ