������ʼִ��
Static task
static1
Behavioral task
behavioral1
Sample
291d2b4f563df65761a4240540d34feb_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
291d2b4f563df65761a4240540d34feb_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
291d2b4f563df65761a4240540d34feb_JaffaCakes118
-
Size
54KB
-
MD5
291d2b4f563df65761a4240540d34feb
-
SHA1
4c57f3cbc47ca3c5857f51006a9869d1e958eac1
-
SHA256
3bde9b3a44358443e372bae4895fb4d2ebb72b893e3c6699e98806c8b0e894bc
-
SHA512
600ffe4c42feef4aaa07f3de7b1b4d9c5c09a8b3de607041df9c8e2ba7ef215e66e6c2cf871deeff5b82c898bb0f705242f049dc74f1141399d02d404905a3b0
-
SSDEEP
768:LA5tXOdqfpmLVcSru2whV9RUtazlncxh+vz3XkBN/ExC:LA5tXOwsSV9RCEltz3XYxEx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 291d2b4f563df65761a4240540d34feb_JaffaCakes118
Files
-
291d2b4f563df65761a4240540d34feb_JaffaCakes118.dll windows:4 windows x86 arch:x86
d1b1d470695815e5d2859c5f33b4954e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrlenA
FindFirstFileA
FindClose
FindNextFileA
FreeLibrary
HeapFree
ExitProcess
HeapReAlloc
HeapAlloc
Sleep
lstrcpyA
GetProcessHeap
GetProcAddress
LoadLibraryA
GetLastError
lstrcatA
GetModuleHandleA
lstrcmpA
GetModuleFileNameA
GetCommandLineA
user32
wsprintfA
MessageBoxA
Exports
Exports
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 600B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 738B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.ecode Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ