Static task
static1
Behavioral task
behavioral1
Sample
e28f5e5e5cd6019383276505b054ba54_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e28f5e5e5cd6019383276505b054ba54_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
e28f5e5e5cd6019383276505b054ba54_JaffaCakes118
-
Size
51KB
-
MD5
e28f5e5e5cd6019383276505b054ba54
-
SHA1
90f69eb2ec73651b52a3dfe6bfdc3451e922011a
-
SHA256
b2dabb9e7c34775c6fbb020f28d526fc492344b2173b88d348ee23a06add92c4
-
SHA512
3e5f27fda239f93380802e4ae56925871cd16314e47143d5d43ad34fd6407c2b5216b43973c4d1c877985b320a356fba5243050fadccb940503db1ebf27803e5
-
SSDEEP
1536:LXdwbGLaGmR4q1j1pzOhnVsYxEA++yxadIeUYaTjug:LNwbJTJpzOhJ+jxyUrTf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e28f5e5e5cd6019383276505b054ba54_JaffaCakes118
Files
-
e28f5e5e5cd6019383276505b054ba54_JaffaCakes118.dll windows:4 windows x86 arch:x86
de6d860f1ec4159811b58c1aa3aa4621
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
RtlZeroMemory
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
ReadFile
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
LoadLibraryA
HeapReAlloc
HeapFree
HeapAlloc
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVersionExA
GetProcessHeap
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetModuleFileNameA
GetFullPathNameA
GetFileSize
FindNextFileA
FindFirstFileA
FindClose
FindAtomA
ExitThread
DeleteAtom
CreateThread
CreateFileA
CloseHandle
WideCharToMultiByte
AddAtomA
advapi32
RegQueryValueExA
RegOpenKeyA
RegEnumKeyExA
RegCloseKey
CryptReleaseContext
CryptHashData
CryptDestroyKey
CryptDestroyHash
CryptDeriveKey
CryptDecrypt
CryptCreateHash
CryptAcquireContextW
user32
CharUpperA
Sections
.text Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ