NSGetModule
Behavioral task
behavioral1
Sample
f192e005be87007fb28267eb332f86f5_JaffaCakes118.dll
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
f192e005be87007fb28267eb332f86f5_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f192e005be87007fb28267eb332f86f5_JaffaCakes118
-
Size
429KB
-
MD5
f192e005be87007fb28267eb332f86f5
-
SHA1
567ae32fdb913be3d56e9541e41683f3f38aac47
-
SHA256
f17e165504d049a861950d8b6e507dd4c598ec96c46b438237639d48c2666af0
-
SHA512
ff253e014927e35faef13f77865d25d462ed563c33bffd10dde581b1f26dd1e4ae886562b1396f5fddc2fd53175869a1d8e2d0fb5d01bc5459d5c2b44d8a2901
-
SSDEEP
6144:I+JddWNzfXVvFQrnvhAWhI966AGkAjOpoaY7+Ug76Eh4Pp/iMjN9scdfI:7TWLtdyq6xGJOpqCUzEh4Pp/iMBWII
Malware Config
Signatures
-
resource yara_rule sample aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f192e005be87007fb28267eb332f86f5_JaffaCakes118
Files
-
f192e005be87007fb28267eb332f86f5_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
Size: 82KB - Virtual size: 232KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 26KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 13KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 291KB - Virtual size: 292KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE