Behavioral task
behavioral1
Sample
5562b80495eff2df455b9aaafb336bb9_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5562b80495eff2df455b9aaafb336bb9_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
5562b80495eff2df455b9aaafb336bb9_JaffaCakes118
-
Size
56KB
-
MD5
5562b80495eff2df455b9aaafb336bb9
-
SHA1
2edb1ba46690d24b6b17505cd253f9bff1d68c69
-
SHA256
5d8b7de71a40a17e7da8b40362ae7c6fa77d17d5074aa20a982e9ea6c06998b7
-
SHA512
1b155d08d81a370b013fc8978b94ed0f294f1031466e6154aa64fecd29ca40973c708d03bbdc983f89b5adc512ef095d99ec0804b9af4292a62d64869ec991bd
-
SSDEEP
1536:NCNg/jP2hWHDUtJdf7XjQAwLi34M8zeRYiGtnNpMK4sSSpyPJ:qjf7XcA34M8EYiGtnXM0Fk
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5562b80495eff2df455b9aaafb336bb9_JaffaCakes118
Files
-
5562b80495eff2df455b9aaafb336bb9_JaffaCakes118.dll windows:4 windows x86 arch:x86
6433fc334c4f4917955f0e35c0c3b4b6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
GetFileSize
ReadFile
CreateFileA
lstrcpynA
DeleteFileA
GetTempPathA
MultiByteToWideChar
GlobalFree
GlobalUnlock
WriteFile
GlobalLock
GlobalAlloc
Process32Next
GetTickCount
CreateToolhelp32Snapshot
GetModuleHandleA
VirtualAlloc
GetPrivateProfileStringA
CreateThread
WritePrivateProfileStringA
GetSystemTime
WideCharToMultiByte
IsBadReadPtr
SetFilePointer
GetLastError
CreateMutexA
GetCurrentProcessId
GetModuleFileNameA
lstrlenA
lstrcmpiA
lstrcmpA
Sleep
ExitProcess
VirtualProtect
lstrcpyA
GetSystemDirectoryA
lstrcatA
LoadLibraryA
GetProcAddress
FreeLibrary
Process32First
OutputDebugStringA
user32
EnumWindows
ReleaseDC
GetDC
IsRectEmpty
GetWindowThreadProcessId
FindWindowExA
FindWindowA
PrintWindow
GetWindowInfo
SetForegroundWindow
ShowWindow
GetActiveWindow
IsIconic
GetWindowTextA
GetSystemMetrics
IsWindowVisible
gdi32
CreateCompatibleBitmap
CreateCompatibleDC
GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetObjectA
DeleteDC
GetDeviceCaps
CreateDCA
DeleteObject
BitBlt
SelectObject
wininet
HttpEndRequestA
HttpSendRequestExA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetCloseHandle
ws2_32
shutdown
inet_ntoa
gethostbyname
gdiplus
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCloneImage
GdipDisposeImage
GdipFree
GdiplusShutdown
GdipAlloc
GdipLoadImageFromFile
GdipSaveImageToFile
GdiplusStartup
msvcrt
free
atoi
??3@YAXPAX@Z
wcscmp
??2@YAPAXI@Z
strstr
memmove
strrchr
sprintf
_except_handler3
_local_unwind2
malloc
shlwapi
StrChrW
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ