client
Static task
static1
Behavioral task
behavioral1
Sample
310cc33829f149c0913ed5f79f213ec5_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
310cc33829f149c0913ed5f79f213ec5_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
310cc33829f149c0913ed5f79f213ec5_JaffaCakes118
-
Size
40KB
-
MD5
310cc33829f149c0913ed5f79f213ec5
-
SHA1
1f22f940c5f0905b8ddbf452efadb23d5c942ccb
-
SHA256
1551ec21970495f40f423341bcdcbde5744560418e47c01c6cccdeb74f6e6946
-
SHA512
94325996d4f680ff0a3a0fbd41e289e559d1e9a3de8ae634ec1f4d64ec281ec5deb41a9e6d55e66e02a39fda3296c0f15c5b86b1e7ad16309335730c0c5a7a35
-
SSDEEP
384:hilBczXTxNSpbCD/0cFMYco74mlKWDmCXU/yLYq0+Xg2aoU7Qi/ik:hmKxNG2D/j179cgN0gCoUsi/7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 310cc33829f149c0913ed5f79f213ec5_JaffaCakes118
Files
-
310cc33829f149c0913ed5f79f213ec5_JaffaCakes118.dll windows:4 windows x86 arch:x86
87a486c25f7d7800ccdbe2f3e727ab33
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FreeEnvironmentStringsA
GetSystemDirectoryA
WideCharToMultiByte
GetModuleFileNameA
CloseHandle
RtlUnwind
FlushFileBuffers
GetStringTypeW
GetStringTypeA
FreeEnvironmentStringsW
LCMapStringA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
HeapDestroy
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
LCMapStringW
GetVolumeInformationA
MultiByteToWideChar
VirtualAlloc
GetEnvironmentStrings
GetEnvironmentStringsW
DisableThreadLibraryCalls
WriteFile
GetLastError
SetFilePointer
HeapAlloc
GetACP
HeapReAlloc
GetCPInfo
GetOEMCP
GetProcAddress
LoadLibraryA
SetStdHandle
shell32
StrCmpNA
ws2_32
WSAStartup
gethostname
gethostbyname
WSACleanup
netapi32
Netbios
Exports
Exports
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ