AveProc
Static task
static1
Behavioral task
behavioral1
Sample
043d6af9afd455598dd0bd121e0c357a_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
043d6af9afd455598dd0bd121e0c357a_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
043d6af9afd455598dd0bd121e0c357a_JaffaCakes118
-
Size
500KB
-
MD5
043d6af9afd455598dd0bd121e0c357a
-
SHA1
3bc391d4f9ec11515c53f5bd2c1ed38469c0aef2
-
SHA256
c1c2261af911759f369a0bcbb3527872790d6eb4f6a62331614aaeb6460dd0fb
-
SHA512
de14daf0e2b87ca517ae81954c440b51f662cdf87037e7ac57f3973e6ffe33c26a98e5b4b74464e2529fe15d057d1dc1bed5a4087db108d98daba50e095f77fb
-
SSDEEP
6144:hv+iIYVoPwVU2OSu/ldi213JS44ZUyoVbMqVjHEw57FDRoGdboCRXTUk:h2ilVo5hNx5S4qKMqVjHhuWboCRXTUk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 043d6af9afd455598dd0bd121e0c357a_JaffaCakes118
Files
-
043d6af9afd455598dd0bd121e0c357a_JaffaCakes118.dll windows:4 windows x86 arch:x86
9275bd98bc58393ae22ad6032afdd9f7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FindNextFileA
FindFirstFileA
GetLastError
FileTimeToDosDateTime
FindClose
GetVersion
GetProcAddress
FreeLibrary
GetModuleFileNameA
LoadLibraryA
SetLastError
GetDriveTypeA
CreateFileA
CloseHandle
SetFilePointer
ReadFile
DeviceIoControl
WriteFile
GetStdHandle
HeapAlloc
HeapFree
MoveFileA
GetTimeZoneInformation
GetSystemTime
GetLocalTime
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TerminateProcess
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
RtlUnwind
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetFileType
GetStartupInfoA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
FlushFileBuffers
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetFileAttributesA
GetFileAttributesA
SetEndOfFile
DeleteFileA
RemoveDirectoryA
CreateDirectoryA
GetFullPathNameA
GetCurrentDirectoryA
Exports
Exports
Sections
.text Size: 412KB - Virtual size: 409KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 720B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ