Static task
static1
Behavioral task
behavioral1
Sample
29a586579d14130e611b91a668f3915e_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
29a586579d14130e611b91a668f3915e_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
29a586579d14130e611b91a668f3915e_JaffaCakes118
-
Size
484KB
-
MD5
29a586579d14130e611b91a668f3915e
-
SHA1
a6d1086faf6d6204e38e661fdf0c93637e7817af
-
SHA256
4fb8b54e9cd41dc444e3cb35a57a4b8e4a08ea6d4baeb809945f23413f38fed2
-
SHA512
4a2660fc75bd3125b8c56d9d78aa68fbfb0436abe2d2a43a9498c66bf5eb23d4b78d13e3f315f5fe2af8569f8db088b097215f0cf7e964276a28f026421bd2e7
-
SSDEEP
6144:2S6RQqx51+gOkd6JC+0RCDrsAFSChTTw5Kcl1U+HafZ31MlkbgydBBQjzzLB6oNJ:x6GqROk9RqNSCxbIHaR31wWYB6PO5BR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29a586579d14130e611b91a668f3915e_JaffaCakes118
Files
-
29a586579d14130e611b91a668f3915e_JaffaCakes118.dll windows:4 windows x86 arch:x86
a1ec8dce401eba16d45a4f1aa06ebd77
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExitProcess
VirtualProtect
ExitThread
CreateFileA
WriteFile
CloseHandle
msvcrt
memset
_CIacos
memcmp
_mbsnicmp
_mbsncmp
Sections
.text Size: 312KB - Virtual size: 311KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE