Static task
static1
Behavioral task
behavioral1
Sample
3b7422ffb8d06cae78417913a72468ba_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3b7422ffb8d06cae78417913a72468ba_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3b7422ffb8d06cae78417913a72468ba_JaffaCakes118
-
Size
47KB
-
MD5
3b7422ffb8d06cae78417913a72468ba
-
SHA1
092cd57d01319a40720778eee0add2095d87d304
-
SHA256
e6aa7a426b997ab4ccedd4112d75a8d5cb0af0de44844286c22f6957098ff95a
-
SHA512
d054cfbfa77da257d2b8f2867b1f8f0c56ebdeeeb0f87b6dea094bd9631ca5b39a684b18c95c8aecce2feee24fdaf4e60db5653fb13f5d0cfff41548e0fdb1cc
-
SSDEEP
768:hzKZnFciMe0kGl1m7LntbmOPIbD4UpjQdNiUU/ptRvIUYNB0b:9KhkkqY7LtfCD4UpYiUU/pfu0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3b7422ffb8d06cae78417913a72468ba_JaffaCakes118
Files
-
3b7422ffb8d06cae78417913a72468ba_JaffaCakes118.dll windows:4 windows x86 arch:x86
30fbaf7efca3c098bfa87babbd19e62b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntoskrnl.exe
memcpy
RtlClearBits
MmFreeContiguousMemory
ZwLoadDriver
MmGrowKernelStack
RtlCharToInteger
SeSetSecurityDescriptorInfo
RtlRaiseException
RtlImageNtHeader
RtlNtStatusToDosErrorNoTeb
NlsAnsiCodePage
IoAcquireCancelSpinLock
ExAllocatePool
ZwCreateFile
ExFreePool
MmGetPhysicalAddress
ExInterlockedPushEntrySList
RtlCreateRegistryKey
ZwQueryValueKey
IoInitializeRemoveLockEx
RtlCreateUnicodeString
MmSizeOfMdl
KeI386Call16BitFunction
hal
HalReadDmaCounter
HalAllocateAdapterChannel
HalGetInterruptVector
HalHandleNMI
HalStartProfileInterrupt
HalSetBusData
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 903B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 39KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 38B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ