Static task
static1
Behavioral task
behavioral1
Sample
3172ef247917b8853841ba3dda8dcb45_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3172ef247917b8853841ba3dda8dcb45_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3172ef247917b8853841ba3dda8dcb45_JaffaCakes118
-
Size
56KB
-
MD5
3172ef247917b8853841ba3dda8dcb45
-
SHA1
a0c064ca7aceb06d926455837e46c4015d6d65d5
-
SHA256
02cc69f2650cce8c05c26c5a06662fcb86ef36b16720a7a25f861fea2fca57d9
-
SHA512
94c50894343b0301bc2e32ff935c85cc7f3afb00a71d3704f705c0950ece4737a0c1d49a2e33d878ddba61e415df6a01f9d1b98c23711ae87d6d1fd2a652d133
-
SSDEEP
192:v4qQoVfD4d5MlT4Y6owAUXJuXFF1gw/POeEQxWdZU6+:Nx+/MF4Y6odUZuVF1JPOeRxWYP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3172ef247917b8853841ba3dda8dcb45_JaffaCakes118
Files
-
3172ef247917b8853841ba3dda8dcb45_JaffaCakes118.dll windows:4 windows x86 arch:x86
c78b9f689302bc97e17a06db6157b46a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord4465
ord4202
ord860
ord535
ord3953
ord1176
ord1575
ord1168
ord1116
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord5731
ord3922
ord2512
ord2554
ord4486
ord6375
ord800
ord540
ord2764
ord4274
ord269
ord826
ord600
ord1578
ord6467
msvcrt
??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
_mbscmp
__CxxFrameHandler
??2@YAPAXI@Z
kernel32
LocalFree
CopyFileA
FindFirstFileA
GetWindowsDirectoryA
GetModuleHandleA
LoadLibraryA
Module32First
Module32Next
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
OutputDebugStringA
LocalAlloc
advapi32
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
Sections
.zzz1 Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.yyyy1 Size: 4KB - Virtual size: 272B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zzzz2 Size: 4KB - Virtual size: 208B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zzzz3 Size: 4KB - Virtual size: 304B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.yyyy2 Size: 4KB - Virtual size: 240B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zzzz5 Size: 4KB - Virtual size: 48B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.yyyy3 Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.yyyy4 Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 938B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ