F:\eqlK\wIgfvjpjVpix4\pArpsrE\qcbcsjemr.kOb
Static task
static1
Behavioral task
behavioral1
Sample
0c61d03709e422bc2956c971f81ff232_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0c61d03709e422bc2956c971f81ff232_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0c61d03709e422bc2956c971f81ff232_JaffaCakes118
-
Size
42KB
-
MD5
0c61d03709e422bc2956c971f81ff232
-
SHA1
f1323be1644f78e9378f6ad1382731c78aad9cd9
-
SHA256
491ab3b738cf1f7cac011916963709681c24813cf6cd9b19f8a198a5e70aa88f
-
SHA512
79330ee8ca7c4c291bb5c9365b2a5bed129c75fd0a68125ee11575475da7cc3c527fe9eb86c6d32959ef5cb1c092a7eb293734d489513c05d3baadc043c61162
-
SSDEEP
768:HjjlTmlaLP4E1r/XmR62Nqm/lblVHwlutXkm2rtH9bS973Hxp4PgTL:H9ClaDJ1jdOlyQ6pdbS9rRpR/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c61d03709e422bc2956c971f81ff232_JaffaCakes118
Files
-
0c61d03709e422bc2956c971f81ff232_JaffaCakes118.dll windows:5 windows x86 arch:x86
a6f40a55ae949842beeb2f2f690f7ca9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
SeFreePrivileges
SeDeleteObjectAuditAlarm
SeOpenObjectAuditAlarm
SeTokenType
IoInitializeTimer
VerSetConditionMask
strstr
ZwFlushVirtualMemory
RtlUnicodeStringToAnsiString
RtlInsertElementGenericTableFull
RtlInitString
RtlDeleteElementGenericTable
RtlCompareString
RtlTimeFieldsToTime
ZwFreeVirtualMemory
_vsnwprintf
RtlFreeAnsiString
RtlCopyString
RtlEqualString
KeTickCount
wcsspn
RtlInitializeGenericTable
memset
Exports
Exports
__ExDisableResourceBoostLite@4
__ExInitializePushLock@0
__SeLengthSid@4
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ