Static task
static1
Behavioral task
behavioral1
Sample
245eafa8e14ae8630bd14f98c0fb1c03_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
245eafa8e14ae8630bd14f98c0fb1c03_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
245eafa8e14ae8630bd14f98c0fb1c03_JaffaCakes118
-
Size
96KB
-
MD5
245eafa8e14ae8630bd14f98c0fb1c03
-
SHA1
58cef0a277e9ab435aa7b34ab7c8f770f5772df9
-
SHA256
a90bac1823e13135ff1eef1ede4016dbc6097095ab78984ef48b90ae87bd7e6c
-
SHA512
4cc812d4d0e921e39e400bb0ad4c544646cb06b2881658ff7322364361f109a3e7f4f9fd8c9b21273c95a468d45d70c419c6cce5ada78b1ba230ac04c75f44d7
-
SSDEEP
1536:rllcoFhfIV0LWpGl/MAIhKQo6Axewf3JNCHBb+uB7Q+wXoC:rlpVIOaRKQorFJMHBNqz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 245eafa8e14ae8630bd14f98c0fb1c03_JaffaCakes118
Files
-
245eafa8e14ae8630bd14f98c0fb1c03_JaffaCakes118.dll windows:4 windows x86 arch:x86
98e2336c68d4e1b1ff74da2f0327fc7c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetStringTypeA
CreateDirectoryW
SetFileAttributesW
LocalFree
LocalAlloc
GetComputerNameA
GetProcAddress
LoadLibraryA
CloseHandle
GetProcessHeap
GetCurrentThread
LoadLibraryW
GetSystemDirectoryW
GetCurrentProcess
VirtualProtect
GetCommandLineA
LCMapStringW
RtlUnwind
GetVersion
ExitProcess
TerminateProcess
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
HeapAlloc
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
GetStringTypeW
user32
wsprintfW
advapi32
SetSecurityDescriptorDacl
InitializeAcl
AllocateAndInitializeSid
GetLengthSid
InitializeSecurityDescriptor
FreeSid
AddAccessAllowedAce
RegCloseKey
EqualSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
GetSidSubAuthority
GetAce
GetAclInformation
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
MakeSelfRelativeSD
GetSecurityDescriptorControl
GetSecurityDescriptorLength
GetFileSecurityW
Sections
.text Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ