Static task
static1
Behavioral task
behavioral1
Sample
0e4980a2d492cadeab862fd20e42b698_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0e4980a2d492cadeab862fd20e42b698_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
0e4980a2d492cadeab862fd20e42b698_JaffaCakes118
-
Size
62KB
-
MD5
0e4980a2d492cadeab862fd20e42b698
-
SHA1
c98c2ca4513272b4f44fe01f861f67f82cb22aca
-
SHA256
4c2d56f982092432cf172fd75d757543bef7767737233b76461ccaab0169be9a
-
SHA512
e474bde0c2bdbcce3b20d6ca40fa91e785429c6fde85ed5e04c9392af75ff4306c80658f485dde0f53ea02b7f10322d178daeabf481b3793f01caa83d9c60983
-
SSDEEP
768:sqcsJzCHstbxfniNvmYAVFixrNN58uliZ+0cGoGbmx1GLlKMPoJKMlkjCW/xOHZQ:s0JRni5mtaVJhcYGo4hfP4ejlw/+t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e4980a2d492cadeab862fd20e42b698_JaffaCakes118
Files
-
0e4980a2d492cadeab862fd20e42b698_JaffaCakes118.dll windows:4 windows x86 arch:x86
ceca7d0a6cccd2ca29f493a594f72165
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCommandLineA
GetTickCount
VirtualProtect
GetVersion
ReadFile
CreateMailslotW
CloseHandle
WriteFile
CreateFileW
GetComputerNameW
WriteConsoleW
ExitProcess
HeapFree
HeapAlloc
GetProcessHeap
SetLastError
CompareStringW
lstrlenW
GetStdHandle
FormatMessageW
LocalFree
GetConsoleOutputCP
WideCharToMultiByte
GetThreadLocale
GetLastError
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LocalAlloc
TerminateProcess
msvcrt
__CxxFrameHandler
_except_handler3
memset
_iob
_memicmp
_errno
fflush
fprintf
wcstoul
wcstol
wcstok
_initterm
free
malloc
_adjust_fdiv
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 33KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ