ControlProc
Static task
static1
Behavioral task
behavioral1
Sample
01588197e9ed2eaada691daa718d39e5_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
01588197e9ed2eaada691daa718d39e5_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
01588197e9ed2eaada691daa718d39e5_JaffaCakes118
-
Size
25KB
-
MD5
01588197e9ed2eaada691daa718d39e5
-
SHA1
a9a8441231db8c92fefe91d6195d33eac7024f84
-
SHA256
56c6464ba51205c75338cc9c79a99bca15c3acd9cf17bfbd6663b5969f414d07
-
SHA512
f6e6af15ee81d01c2385c308b3a52b56d0909cde84bec4447bcea53577c6403933df95c4104220f6ea9d90d24eae3d0b0229123df42e7fe04003e3806ef62c37
-
SSDEEP
384:WuZOa8kQDpLQEzBgwkhX91KCNAKqvD34MG4apnY150cnMz224tK:pbkgh1KPD34M9ai15lMz22Q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 01588197e9ed2eaada691daa718d39e5_JaffaCakes118
Files
-
01588197e9ed2eaada691daa718d39e5_JaffaCakes118.dll windows:4 windows x86 arch:x86
ce0ab8262bc68491a107c4cb2781aff3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleFileNameA
SetLastError
lstrcmpiA
GlobalFree
GlobalAlloc
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetSystemInfo
CloseHandle
Module32Next
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
VirtualQuery
WriteProcessMemory
GetCurrentProcess
VirtualProtect
lstrcpyA
lstrlenA
GetVersionExA
GetLocalTime
lstrcpynA
GetProcessTimes
Sleep
CreateProcessA
GetSystemDirectoryA
GetLastError
CreateMutexA
lstrcatA
WriteFile
CreateFileA
ReadFile
GetFileSize
RaiseException
ExitProcess
GetCommandLineA
GetTickCount
DeleteFileA
SetFilePointer
GetSystemTime
RtlUnwind
Exports
Exports
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ