Behavioral task
behavioral1
Sample
ff9c5c671741be6e7505c26427a87c0e_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
ff9c5c671741be6e7505c26427a87c0e_JaffaCakes118
-
Size
186KB
-
MD5
ff9c5c671741be6e7505c26427a87c0e
-
SHA1
8c0866974dfa3e10519acbfa89b1efbd74b2e202
-
SHA256
63a4eb30d98b9a4b2f25c683d667deb64c72264945abadabe727809448bf895e
-
SHA512
cbd3b1b1eda5055eb7e3d6f9677650c1596de52610351424cc97b38158e819a86c0f592aa1978eba976e5895bb2311c8472af5bf3169095aef68abb09af8805c
-
SSDEEP
3072:padgsfQro1xXr12DbP8/gs54dr0lXFyObZAijspgdk5N8aqt8gQp5j:padgs4ro15rQP87+AXFyOb1j1i5NSQp5
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff9c5c671741be6e7505c26427a87c0e_JaffaCakes118
Files
-
ff9c5c671741be6e7505c26427a87c0e_JaffaCakes118.dll windows:5 windows x86 arch:x86
144cb567a31cff2f934e9c6a4e43a60a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
OutputDebugStringA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetRect
shell32
ShellExecuteA
msvcr90
_finite
gdi32
SelectObject
advapi32
RegOpenKeyA
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 183KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ