BotMainDllExp
Static task
static1
Behavioral task
behavioral1
Sample
148cebca9ee9c909f0441ec31eadb98c_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
148cebca9ee9c909f0441ec31eadb98c_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
148cebca9ee9c909f0441ec31eadb98c_JaffaCakes118
-
Size
36KB
-
MD5
148cebca9ee9c909f0441ec31eadb98c
-
SHA1
0d00849ff6f240a30f3219ef4f7cd66681364467
-
SHA256
59bf0c6c951cf89f7a95c62230f5ec38ab92820c0322d63da1da228838939f15
-
SHA512
dec195c72ea1f9ce5e80826ca38ee578a854ff9f6bb97ce22ba36410dab0e1522844e3de7cbfb5e092a09f63bcd0bd7ba63c85bd5ce5de2bd6b6e676520f49a8
-
SSDEEP
768:fZlQAtT2wv+YrTSX1/J1ksbS9KpASvoURnLWU:/QOvrTSF/J1lSCZoJU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 148cebca9ee9c909f0441ec31eadb98c_JaffaCakes118
Files
-
148cebca9ee9c909f0441ec31eadb98c_JaffaCakes118.dll windows:4 windows x86 arch:x86
1d8845c9bed1417d684745e65c1021c9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
OpenProcess
VirtualFreeEx
FreeLibrary
GetProcAddress
GetExitCodeThread
WaitForSingleObject
CreateRemoteThread
LoadLibraryA
WriteProcessMemory
VirtualAllocEx
VirtualQueryEx
GetCurrentProcessId
GetSystemDirectoryA
DisableThreadLibraryCalls
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
RtlUnwind
Exports
Exports
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ