Static task
static1
Behavioral task
behavioral1
Sample
424ec7c7bfe656e4bc77868a6f109400_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
424ec7c7bfe656e4bc77868a6f109400_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
424ec7c7bfe656e4bc77868a6f109400_JaffaCakes118
-
Size
16KB
-
MD5
424ec7c7bfe656e4bc77868a6f109400
-
SHA1
a30a11f9cad2eb2ee8351d5c412ba010f9d12481
-
SHA256
b565d7bc0681e4239b71bbc3768d27f70959f31ba8508aedff3f2d9ac7ef400e
-
SHA512
29f7dace83024f962253190374147338e882f11d10e7ec01993643685e1ce298475afe5ad4f75e99a47838bff290ef4f9b96e5896ef3f9914dedfb7a0da0ca1f
-
SSDEEP
192:sAxP9VsxGKr8NabdX7YWOlh2jkefagpGOobamzlg0yfE18jHx/iI:LxuNrndX7SopaRamzlgRB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 424ec7c7bfe656e4bc77868a6f109400_JaffaCakes118
Files
-
424ec7c7bfe656e4bc77868a6f109400_JaffaCakes118.dll windows:4 windows x86 arch:x86
4ab64aebae0dd65a5d0dda9f9befd033
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntoskrnl.exe
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
ObfDereferenceObject
ExAllocatePoolWithTag
ZwQuerySystemInformation
MmUnlockPages
IoFreeMdl
MmUnmapLockedPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
IoAllocateMdl
_except_handler3
Sections
.text Size: 1024B - Virtual size: 972B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 86B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 512B - Virtual size: 468B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 130B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ