Behavioral task
behavioral1
Sample
0964b39d8ef7063fbcb1104cf54e23ec_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0964b39d8ef7063fbcb1104cf54e23ec_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
0964b39d8ef7063fbcb1104cf54e23ec_JaffaCakes118
-
Size
140KB
-
MD5
0964b39d8ef7063fbcb1104cf54e23ec
-
SHA1
1a47bfad9198160575d617d6397c43c256eb67f4
-
SHA256
f8dad7bcc4bbce8cb5205887ff1da23ad616c1a597bfafda9398b7c5e8e1f8d1
-
SHA512
8f2bd9dcde766b1ffb5c7eebb7ba38ffc37f4be11cf0345ddc68046fcbbffbc7da1579f06692978da2ae072dce30eb3c5c375479d8a0eebe93c215b2ce2c7764
-
SSDEEP
3072:lKD50gO2CUW0SspnGTLx9+qJvtV/qwPsxJ5tzVuSgyk51:lc50g1ClstG3/+mFdFEXPzVM
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0964b39d8ef7063fbcb1104cf54e23ec_JaffaCakes118
Files
-
0964b39d8ef7063fbcb1104cf54e23ec_JaffaCakes118.dll windows:4 windows x86 arch:x86
4b23b38cba768a96c68b0663113ae389
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CompareStringA
ExitThread
GetLastError
GetPrivateProfileStringA
GetStartupInfoA
GetSystemTime
GetTimeFormatA
GetVersion
InitializeCriticalSection
RaiseException
RtlUnwind
SetCurrentDirectoryA
SetEndOfFile
SetLastError
TlsSetValue
VirtualAlloc
lstrcatA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
user32
ActivateKeyboardLayout
BeginPaint
ChangeMenuA
CharToOemBuffA
CopyRect
CreatePopupMenu
DestroyIcon
DestroyMenu
DestroyWindow
DialogBoxParamA
DrawIcon
DrawMenuBar
EnableWindow
EndDialog
EndMenu
GetDlgItem
GetFocus
IsCharLowerA
IsCharUpperA
LoadAcceleratorsW
SetCursor
Sections
UPX0 Size: 1024B - Virtual size: 264KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 107KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.protect Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE