RunningRat
Static task
static1
Behavioral task
behavioral1
Sample
341381d3ac281fc1b3900be117f67274_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
341381d3ac281fc1b3900be117f67274_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
341381d3ac281fc1b3900be117f67274_JaffaCakes118
-
Size
87KB
-
MD5
341381d3ac281fc1b3900be117f67274
-
SHA1
06948ab527ae415f32ed4b0f0d70be4a86b364a5
-
SHA256
29431dc086499c7ee64236a365615be5e5c861452f047ffac5656120ece59266
-
SHA512
19bae1b28db2d0efdcebf22187c1a9a02a257ef63f4f29864339ef0864f7455fcb538f9f020c29d5549d023e97536a7f48ed2baa63fdeeb43918ca64c8b694cf
-
SSDEEP
1536:oORSuuEJOj8AxibBeNSjd9g/VlDAu/7a3i+yjbRBJ28DLtY:Ruxj8zBPLIrDaRyXRRtY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 341381d3ac281fc1b3900be117f67274_JaffaCakes118
Files
-
341381d3ac281fc1b3900be117f67274_JaffaCakes118.dll windows:5 windows x86 arch:x86
0606858bdeb129de33a2b095d7806e74
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateMutexA
GetLocalTime
GetModuleHandleA
GetShortPathNameA
GetTickCount
QueryPerformanceCounter
Sleep
CloseHandle
GetLastError
GetCurrentProcess
GetProcAddress
LoadLibraryA
lstrcatA
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
GetCurrentThreadId
InterlockedExchange
user32
wsprintfA
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
shell32
SHGetSpecialFolderPathA
msvcr90
??2@YAPAXI@Z
strstr
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
malloc
fclose
fprintf
fopen
vsprintf
strrchr
_stricmp
memset
free
memcpy
Exports
Exports
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1022B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ