od.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f996e58393da72d1d54124e1f98f375b_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f996e58393da72d1d54124e1f98f375b_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f996e58393da72d1d54124e1f98f375b_JaffaCakes118
-
Size
54KB
-
MD5
f996e58393da72d1d54124e1f98f375b
-
SHA1
df99b5a0d59f5e21dacc20bf1a6b1a157a55dfbc
-
SHA256
5137c584d4f1a5caf62f8c003c131107bbc181a14cf7f625485123313a77ea12
-
SHA512
53da512375058455821e2c31820caab2c9d158b27e0fdfd44746939d0f5bbe4f2feed3143584c94c58d42f1019d0f965b6d7e5ac3737a9f97527cc2a6f107157
-
SSDEEP
768:dni4Qe1vZl2qsmjZ92C1wp2J14wzyqG6J7wIPnLNuiaIyasi8rR:smf8+juoG2J14wFG6RFPLQIya4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource f996e58393da72d1d54124e1f98f375b_JaffaCakes118
Files
-
f996e58393da72d1d54124e1f98f375b_JaffaCakes118.dll windows:4 windows x86 arch:x86
95f44b6a1f284e846c47d1648f742161
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
HeapReAlloc
HeapDestroy
OpenEventW
FindResourceExW
FindResourceW
Beep
HeapAlloc
GetProcessHeap
HeapFree
SetFilePointerEx
SetLastError
ExitProcess
rpcrt4
RpcEpUnregister
RpcEpRegisterW
RpcStringBindingParseW
RpcBindingToStringBindingW
RpcBindingVectorFree
crypt32
CryptProtectData
Exports
Exports
fpmy
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 987B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ