Behavioral task
behavioral1
Sample
deb3ed21304ee52407a2628acaac4a78_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
deb3ed21304ee52407a2628acaac4a78_JaffaCakes118
-
Size
228KB
-
MD5
deb3ed21304ee52407a2628acaac4a78
-
SHA1
fe6efa7e67c276c361a85665e7b00c87d917008e
-
SHA256
59bbcf7eccde56f7d927edbe19cbb7ae9e0e11e19645a10ba6f78747a4f0454a
-
SHA512
c4bcf777b0bc6864c364d5aebcfa3e484cc5ae610508b5934a68c237f2b64392d3727976c0e5c2ed4175f39ff521a8b53d248dd8687a191a813088f67c9dccdb
-
SSDEEP
6144:d4zpMILQBM0hdQaJONNuXBmIUxiXlJLtm8yZBv0gtTcos4QVB6ohAizQ:uzpMILQO0hdQaJONNuXBmIUxiXlm8yLj
Malware Config
Signatures
-
Detects Talisman variant of PlugX 1 IoCs
resource yara_rule sample family_plugx_talisman -
Plugx family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource deb3ed21304ee52407a2628acaac4a78_JaffaCakes118
Files
-
deb3ed21304ee52407a2628acaac4a78_JaffaCakes118.dll windows:5 windows x86 arch:x86
32e13bde2cbcd29e1511d455e72230fa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WriteFile
MultiByteToWideChar
GetLastError
SetLastError
GetProcAddress
LocalAlloc
LocalFree
GetCurrentThreadId
DecodePointer
GetCommandLineA
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetModuleFileNameW
RtlUnwind
LCMapStringW
GetStringTypeW
HeapSize
IsProcessorFeaturePresent
Sections
.text Size: 194KB - Virtual size: 193KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ