Static task
static1
Behavioral task
behavioral1
Sample
470b7630c31ff8b8bd7c5cbf963bffb7_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
470b7630c31ff8b8bd7c5cbf963bffb7_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
470b7630c31ff8b8bd7c5cbf963bffb7_JaffaCakes118
-
Size
93KB
-
MD5
470b7630c31ff8b8bd7c5cbf963bffb7
-
SHA1
0fcea6c84a544a714b9087bf4594bb51d32a9acd
-
SHA256
0370ba005d5b023bd5c0ff6f484b5f21d456e94d9a6404aea995c65ba2a20d9b
-
SHA512
64f31c7a6e8c765a16908fd61470346baedbf64eddc4536af5c9ab466f7f32708ac245a93ba5ceb7145a75f6309c4350a13d47de0a727a78152494de210b6b61
-
SSDEEP
1536:CModc38TyrVSdGE9xxe5rWvV8R8kqIioydnedMLWu1/Ua6F7Mlh7:HodSoyrVSdGEpeUN8R8kq3oy5lypFgb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 470b7630c31ff8b8bd7c5cbf963bffb7_JaffaCakes118
Files
-
470b7630c31ff8b8bd7c5cbf963bffb7_JaffaCakes118.dll windows:4 windows x86 arch:x86
80c212689c3f38876221d437922f3dae
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
IsDBCSLeadByte
LoadLibraryA
InterlockedIncrement
InterlockedExchange
InterlockedExchangeAdd
GetModuleFileNameA
GetProcAddress
GetVersionExA
MulDiv
GetSystemTimeAsFileTime
GetLocalTime
VirtualAlloc
VirtualProtect
Sleep
QueryPerformanceFrequency
IsDebuggerPresent
GetComputerNameA
GetCurrentThreadId
IsBadCodePtr
GetUserDefaultLCID
user32
GetCursor
GetWindowContextHelpId
GetWindowRect
GetWindowTextLengthA
IsCharLowerA
IsCharAlphaNumericA
GetWindowDC
CopyIcon
GetAncestor
GetTitleBarInfo
GetWindowInfo
GetTopWindow
IsZoomed
IsIconic
GetGUIThreadInfo
GetParent
InSendMessage
IsChild
GetMenuContextHelpId
advapi32
AreAnyAccessesGranted
RevertToSelf
msvcrt
_adjust_fdiv
malloc
_initterm
free
_swab
srand
_set_error_mode
ldiv
__mb_cur_max
_CIacos
_CIsinh
floor
ceil
time
localeconv
ldexp
_pctype
_isctype
_errno
gdi32
GetBitmapDimensionEx
GdiGetBatchLimit
GetStretchBltMode
ole32
CoFileTimeNow
CoDosDateTimeToFileTime
CoRevertToSelf
shell32
ord66
DuplicateIcon
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ