rStones3
Static task
static1
Behavioral task
behavioral1
Sample
f89af2f9895d7a193d5cf1c825c2c3db_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
f89af2f9895d7a193d5cf1c825c2c3db_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f89af2f9895d7a193d5cf1c825c2c3db_JaffaCakes118
-
Size
4.7MB
-
MD5
f89af2f9895d7a193d5cf1c825c2c3db
-
SHA1
8d2b2b68e6fa047d58afd7e026cd378f3fb5c20b
-
SHA256
288bd942aa23d31f90ec3ad7b228a9b9f84f2b2c93764f9a14342363a13086fc
-
SHA512
1a260c50de2b3928a728eae7fe2c73cf0ee73373ac57ee03297da9d4e10189b25bf5dccfa86bfae5a092931b990f6d394e383df7926f02752099724d830dc7b3
-
SSDEEP
98304:2g13YvFzN3ZXgbj9/HaLu5u0Xt9Ak3AQc:2gM2lYp0X3Ak3A
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f89af2f9895d7a193d5cf1c825c2c3db_JaffaCakes118
Files
-
f89af2f9895d7a193d5cf1c825c2c3db_JaffaCakes118.dll windows:5 windows x64 arch:x64
a3572da0710fb8a8331e927b76150c77
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
oleaut32
SysFreeString
GetErrorInfo
SafeArrayPtrOfIndex
advapi32
RegQueryValueExW
RegUnLoadKeyW
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
user32
MessageBoxA
SetClassLongPtrW
EnumDisplayMonitors
CharUpperBuffW
kernel32
GetVersion
GetProcAddress
GetVersionExW
GetVersion
Sleep
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
msimg32
GradientFill
gdi32
UnrealizeObject
version
VerQueryValueW
ole32
OleUninitialize
comctl32
InitializeFlatSB
msvcrt
memset
shell32
Shell_NotifyIconW
comdlg32
GetSaveFileNameW
winspool.drv
OpenPrinterW
GetDefaultPrinterW
gdiplus
GdipDrawCachedBitmap
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 332KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 42KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: - Virtual size: 78B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 4.7MB - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 408B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ