dbg0sym3.p2d3b4
Static task
static1
Behavioral task
behavioral1
Sample
3a44fb30e892659a8a687ee1236ee503_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3a44fb30e892659a8a687ee1236ee503_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3a44fb30e892659a8a687ee1236ee503_JaffaCakes118
-
Size
135KB
-
MD5
3a44fb30e892659a8a687ee1236ee503
-
SHA1
c1af16cf0bd72302e4e256160158595571cb9704
-
SHA256
c1f4f17db29df412d0feee964c40d94d302ce9d45d34e6337da2da4c7d4fa196
-
SHA512
274503f786cde858e235bfb3f2aaab111dcc7c22d0da263715e536e40bf3c7a6f32055b8c5fc77ddf0c78f1f0465549eb30817fdf583bf0636c232bc694091fb
-
SSDEEP
3072:S08tIurcXSdcJXXxsTgjiF0LFHqukkkkfkkkk4kkkZkk:Cu1JXCgkkkkfkkkk4kkkZkk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a44fb30e892659a8a687ee1236ee503_JaffaCakes118
Files
-
3a44fb30e892659a8a687ee1236ee503_JaffaCakes118.dll windows:4 windows x86 arch:x86
e5b230284b90b15ca10cfd4c971bed07
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LoadLibraryExW
HeapSize
SetHandleCount
GetACP
GetEnvironmentStringsW
GetSystemInfo
InterlockedCompareExchange
InterlockedDecrement
GetStartupInfoA
SetLastError
WideCharToMultiByte
IsBadWritePtr
LCMapStringA
CreateFileMappingW
GetStdHandle
VirtualQuery
WaitForSingleObject
ConnectNamedPipe
GetModuleHandleA
CloseHandle
GetVersionExA
GetCurrentProcess
Sleep
GetTickCount
LCMapStringW
FreeEnvironmentStringsW
lstrcatW
CreateTimerQueueTimer
InterlockedExchangeAdd
FreeEnvironmentStringsA
ResetEvent
DeleteTimerQueueTimer
OpenProcess
VirtualAlloc
IsBadReadPtr
lstrcpyW
CreateEventA
ReleaseMutex
GetSystemTimeAsFileTime
CreateThread
IsBadCodePtr
GetEnvironmentStrings
GetFileType
GetCurrentThreadId
HeapFree
ExitProcess
SetEvent
DisconnectNamedPipe
InterlockedIncrement
RtlUnwind
InitializeCriticalSection
GetProcAddress
DeleteCriticalSection
CreateNamedPipeA
HeapCreate
SetUnhandledExceptionFilter
WriteFile
HeapDestroy
CreateMutexW
GetOEMCP
VirtualFree
GetCPInfo
DuplicateHandle
LoadLibraryA
GetCommandLineA
RaiseException
GetLastError
HeapAlloc
QueryPerformanceCounter
LeaveCriticalSection
GetStringTypeA
GetCurrentProcessId
VirtualProtect
GetLocaleInfoA
EnterCriticalSection
GetStringTypeW
ReadFile
MapViewOfFile
GetModuleFileNameA
MultiByteToWideChar
InterlockedExchange
TerminateProcess
UnmapViewOfFile
CopyFileA
UnhandledExceptionFilter
HeapReAlloc
WaitForMultipleObjects
user32
wsprintfW
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
Exports
Exports
kspqgrckisdmhuhnehyomioasthjpxgkoycvzhuiwvndznibxplckhshilpxemswr
Sections
.text Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 35KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 734B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ