Static task
static1
Behavioral task
behavioral1
Sample
ecb48d4c38dc3f1e2e34964f42602f48_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ecb48d4c38dc3f1e2e34964f42602f48_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
ecb48d4c38dc3f1e2e34964f42602f48_JaffaCakes118
-
Size
1.8MB
-
MD5
ecb48d4c38dc3f1e2e34964f42602f48
-
SHA1
9fee0a5b2cafd742a9e99152c1501faa904de907
-
SHA256
58b27239d29fd781352208f40c49aa22c2397dc8d96234b7bfcc5465c66241e8
-
SHA512
e9b9c82f6f6f5f0ca5f7d48a4e5885b35f065b6945c22efd4b89560fae2925fbdb35b10ba7588bb655ccfe9d0aae51b7917697bc9fa0b5edaf8a00e608f7ea21
-
SSDEEP
49152:LmrH5NNGuaiucb2sdcdk3YZ/8/RRLMSaYzRFx1UvoOFMXYsBjb:SrHQuaiucb2sadHZ/8/PYYzRH1UvoOF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ecb48d4c38dc3f1e2e34964f42602f48_JaffaCakes118
Files
-
ecb48d4c38dc3f1e2e34964f42602f48_JaffaCakes118.dll windows:6 windows x86 arch:x86
21f00a4b0ad00eb1bb161f738eabd9d1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
GetProcAddress
Sleep
GetCurrentProcess
VirtualAlloc
DisableThreadLibraryCalls
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
msvcp140
?_Xlength_error@std@@YAXPBD@Z
vcruntime140
memmove
__std_type_info_destroy_list
memcpy
__CxxFrameHandler3
__std_exception_copy
__std_exception_destroy
_CxxThrowException
_except_handler4_common
memset
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_initterm_e
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
_execute_onexit_table
_cexit
_invalid_parameter_noinfo_noreturn
_initterm
_seh_filter_dll
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
Sections
.text Size: 266KB - Virtual size: 268KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.patch Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE