NikitaTob
Static task
static1
Behavioral task
behavioral1
Sample
f228b59d5e202d68ac0b1751b11b6a70_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f228b59d5e202d68ac0b1751b11b6a70_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f228b59d5e202d68ac0b1751b11b6a70_JaffaCakes118
-
Size
28KB
-
MD5
f228b59d5e202d68ac0b1751b11b6a70
-
SHA1
2d66d43637ac88b58d7223fc7e32a368ad258295
-
SHA256
e93ea183e6fd3fef5ea1f700367155373cb0fce16e227402182da6e3983f79c9
-
SHA512
1ced0d526d182ea8e6a9877edb9daeb6d0e2da2833fcd469344b702735a9a018f1e9cb4b1ad9967204662fb070ce5400e9b7e5a0350a02eea3e50de330849da8
-
SSDEEP
192:wAWAA+H2LAx1g/mZBdZDqLFR2Za2NrQXpoJtYIROuJbpVx+AUJ0G2kSzyy0oNxmC:wMAax6/mlYLjw5598qyynyKX4o96Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f228b59d5e202d68ac0b1751b11b6a70_JaffaCakes118
Files
-
f228b59d5e202d68ac0b1751b11b6a70_JaffaCakes118.dll windows:4 windows x86 arch:x86
0f76235d483dc1201e6816e5978fe514
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
GetProcAddress
LoadLibraryA
IsBadReadPtr
GetModuleHandleA
DisableThreadLibraryCalls
GetStringTypeW
GetStringTypeA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
HeapDestroy
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
HeapAlloc
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
RtlUnwind
user32
MessageBoxA
Exports
Exports
Sections
.text Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ