Static task
static1
Behavioral task
behavioral1
Sample
3bfcdd6f77380ec9aacd2c56871ee78d_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3bfcdd6f77380ec9aacd2c56871ee78d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3bfcdd6f77380ec9aacd2c56871ee78d_JaffaCakes118
-
Size
152KB
-
MD5
3bfcdd6f77380ec9aacd2c56871ee78d
-
SHA1
e1211e7367fda7beae16dfaee3e200864b95029f
-
SHA256
b6b2d57f48d03bc94e6bd4dd5d70cdd425152b7906c9961e708f60be2b2f39c5
-
SHA512
d41d8e0baa655979d4908e767a235330552139aa852db56d0cf009405835eb67b3017e2c1f9931e03e81dcc7213d131f90b8d29db7f5e7049fe16cebf50f7bd7
-
SSDEEP
3072:MqqyrtfhRNbzpvAecSZ4TVWrZA+6vhFkLDLgVwWDm:MHyhffNPpvVZzrZA+6vhF4DLYD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3bfcdd6f77380ec9aacd2c56871ee78d_JaffaCakes118
Files
-
3bfcdd6f77380ec9aacd2c56871ee78d_JaffaCakes118.dll windows:4 windows x86 arch:x86
b1138cc78c7db3e2b265c5c8b61768bb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
WriteFile
RtlUnwind
GetCommandLineA
GetVersion
HeapFree
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
VirtualAlloc
HeapReAlloc
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 80KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ