Behavioral task
behavioral1
Sample
2598bd178977a4fc52e7b085ed3a7900_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
2598bd178977a4fc52e7b085ed3a7900_JaffaCakes118
-
Size
313KB
-
MD5
2598bd178977a4fc52e7b085ed3a7900
-
SHA1
fd33bf2b26218055eab527e5812f9d9d5e2a61cf
-
SHA256
a339210bbefae1897df710b0527eb204e186768b09558dccc0dc5d7e653d6173
-
SHA512
784036d623da220fe9e0e8bd51814344f4d4255ce71521b32fe3cac4affb9384d81f2b854d07b372f663a09711704c637f1d99a7f42f9693ee1d102725f10d0e
-
SSDEEP
6144:bRPaoP++1oJ0Ly7nJOEeV6QVBO/cth0Fz3+2TEZe05EKS/L/ie13s:1CkC2yDJOB6QVBicthYu/flS/ri/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2598bd178977a4fc52e7b085ed3a7900_JaffaCakes118
Files
-
2598bd178977a4fc52e7b085ed3a7900_JaffaCakes118.dll windows:5 windows x86 arch:x86
260da42f37dc9d89dbe65367df429a64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateThread
LoadLibraryA
ExitProcess
GetModuleHandleA
IsBadWritePtr
VirtualAlloc
Sleep
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
IsProcessorFeaturePresent
GetSystemInfo
OutputDebugStringA
VirtualFree
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
VirtualProtect
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
CreateWindowExA
GetDesktopWindow
DestroyWindow
DefWindowProcA
MessageBoxA
GetAsyncKeyState
SetRect
RegisterClassExA
MessageBoxA
gdi32
GetCharacterPlacementA
GetCharacterPlacementW
SetBkMode
GetGlyphOutlineA
CreateCompatibleDC
CreateDIBSection
SetMapMode
GetTextMetricsA
GetObjectW
ExtTextOutW
MoveToEx
CreateFontIndirectW
CreateFontIndirectA
GetFontLanguageInfo
GetTextMetricsW
DeleteDC
DeleteObject
ExtTextOutA
SetTextAlign
SetBkColor
SetTextColor
SelectObject
GetObjectA
shell32
ShellExecuteA
msvcp90
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
wininet
InternetOpenUrlA
InternetReadFile
InternetOpenA
d3d9
Direct3DCreate9
msvcr90
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
floor
__CxxFrameHandler
_finite
_CIacos
modf
iswspace
iswalpha
iswdigit
iswpunct
strncpy
_ftol
sprintf
free
??3@YAXPAX@Z
??2@YAPAXI@Z
system
memmove
memset
memcpy
malloc
advapi32
RegQueryValueExA
RegOpenKeyA
RegCloseKey
Sections
.text Size: - Virtual size: 198KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 193KB - Virtual size: 193KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ