SaOpenAt
Static task
static1
Behavioral task
behavioral1
Sample
327e2eab1700b94ea970e8d2763afb52_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
327e2eab1700b94ea970e8d2763afb52_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
327e2eab1700b94ea970e8d2763afb52_JaffaCakes118
-
Size
46KB
-
MD5
327e2eab1700b94ea970e8d2763afb52
-
SHA1
c972beb53265de29c1dd5e822566ede8a3821cbc
-
SHA256
348d6a85abcc9ec08f7960a8b793d4a6bd5c6ccf6bebaa50b34fcd845d4551ca
-
SHA512
3ae524a04fe2b08240695ffd61d7441f903ce0bfc6fb1a6588c9191576c265e8204144b92180fde14b7b0fe5740680e0f7559e2d57dba59b7873c4e9bcfe130b
-
SSDEEP
768:9QPdXncygqpq7RyF12RZsHCBPtQHzI1qkg6y5zrkCLR7mXo9B:90pcyRpkAFWfQTio2W1qo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 327e2eab1700b94ea970e8d2763afb52_JaffaCakes118
Files
-
327e2eab1700b94ea970e8d2763afb52_JaffaCakes118.dll windows:4 windows x86 arch:x86
dabefeec08a472fd82e244d030b5a751
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DisableThreadLibraryCalls
CloseHandle
LoadLibraryA
TlsAlloc
lstrcmpiA
VirtualAlloc
GetTickCount
CreateFileA
GetModuleHandleW
GetVersion
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
ReadFile
GetCurrentThreadId
SetFilePointer
MultiByteToWideChar
GetOEMCP
GetACP
GetProcAddress
GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetCPInfo
RtlUnwind
GetCommandLineA
ExitProcess
TerminateProcess
GetCurrentProcess
HeapDestroy
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
HeapAlloc
HeapReAlloc
user32
GetClientRect
MessageBoxA
GetDC
gdi32
Rectangle
CreateBitmap
shlwapi
PathFileExistsA
StrStrIA
advapi32
RegSetValueExW
RegOpenKeyExA
ole32
CoInitialize
CoTaskMemAlloc
Exports
Exports
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CODEA Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CODEB Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ