Behavioral task
behavioral1
Sample
53f40de357b8d9008bd67f1587216d63_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
53f40de357b8d9008bd67f1587216d63_JaffaCakes118
-
Size
256KB
-
MD5
53f40de357b8d9008bd67f1587216d63
-
SHA1
f9bc38660eb9a2c2146f3bcabff05b6011d674a3
-
SHA256
7f1ef86a49146327ee4e65f1f96a0c8efa10f1da5b9c374cb04a41ffc526735e
-
SHA512
5e91b2113484589005d591b969eb873291a95e53811caeb1e8b788090309ad6bdd9403bb3efe7ba626ffba689a2b3c880846abae2f36786b4b187e086126beb0
-
SSDEEP
6144:mINT+hBiAroa/VAfyQvTJqWPIPh6ba8UkNE7ZJY0phCmQCn:mIZsBlrFwyQvTJ/PIPhziE7/Znn
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 53f40de357b8d9008bd67f1587216d63_JaffaCakes118
Files
-
53f40de357b8d9008bd67f1587216d63_JaffaCakes118.dll windows:4 windows x86 arch:x86
5ab62fa3d2d4e9f1ef8e0808b6a3bdc8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
FindWindowA
MessageBoxA
advapi32
CryptCreateHash
shell32
StrStrIA
psapi
EnumProcessModules
shlwapi
PathFileExistsA
Sections
.text Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 5KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 188KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 248KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ