Static task
static1
Behavioral task
behavioral1
Sample
4564e59ee24385e1c98d9c52a49869a3_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4564e59ee24385e1c98d9c52a49869a3_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
4564e59ee24385e1c98d9c52a49869a3_JaffaCakes118
-
Size
89KB
-
MD5
4564e59ee24385e1c98d9c52a49869a3
-
SHA1
d85663e0adc697ba9576bd4a459acf6d9a9c99b6
-
SHA256
58bab0fed861d4b02f4ebf1acd2cfcc114cbc7c31d6e74b66015271fedc30b77
-
SHA512
434d2d9a407636a0a7593840e355ad6eaf57c9c40d11582c458b7d5ec183db3c997d4a7738f4e8d3a410cf604e1d1f1bae80decb5b33d70f98a0d9c9082a612c
-
SSDEEP
1536:/ZsuOmJuGeTK93qOFVhUlSz3kzYhPvxCVIXvL3s8rY316qqLOQk7h7cr1/GCv:/uHGeTE3qALUlSDkzYhPvkVIXrs8re6d
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4564e59ee24385e1c98d9c52a49869a3_JaffaCakes118
Files
-
4564e59ee24385e1c98d9c52a49869a3_JaffaCakes118.dll windows:4 windows x86 arch:x86
e9c2faf6a1db5779b32f722e67245dd6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualAlloc
GetProcAddress
LoadLibraryA
GetModuleHandleA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetLastError
CreateMutexA
SetLastError
GetModuleFileNameA
VirtualProtect
msvcrt
memset
sprintf
memcpy
Sections
.text Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 508B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 52KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE