Behavioral task
behavioral1
Sample
2bd4378d4155439caa4a7274e3645169_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
2bd4378d4155439caa4a7274e3645169_JaffaCakes118
-
Size
136KB
-
MD5
2bd4378d4155439caa4a7274e3645169
-
SHA1
2737241cf803f5450252e1611674615bd1f3b80a
-
SHA256
7da165c2c4ea980dd027ff8feefb32aec7342f49b82432e781e46d9189536c0d
-
SHA512
ec6e8435d0e3bbd1730c7e04b673e90159473f905a3456b9c9e3eb01b9860d09a11caf4fb8f5991b9d03d123e642eb4f9277405309537d3d063caa21f9ae4052
-
SSDEEP
3072:9SOCmkhYEGTzal6GmSGXrkoUm/VwkM6LsFWUZdB:JCdhYE4a0eq1Um/JLsoUh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2bd4378d4155439caa4a7274e3645169_JaffaCakes118
Files
-
2bd4378d4155439caa4a7274e3645169_JaffaCakes118.dll windows:5 windows x86 arch:x86
e32a2df8be89a0d8456d97d1a2b75af3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
StartServiceA
user32
MessageBoxA
kernel32
GetStartupInfoA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ