protect
Static task
static1
Behavioral task
behavioral1
Sample
4be438646c17ba410324f6a1257d260d_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4be438646c17ba410324f6a1257d260d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4be438646c17ba410324f6a1257d260d_JaffaCakes118
-
Size
10KB
-
MD5
4be438646c17ba410324f6a1257d260d
-
SHA1
07c1bd6572d7dce1ce29a22fe84605caee319704
-
SHA256
bca393c20705a6d9aece4dda0dcc66bec796121f74621e63ca518d4619243120
-
SHA512
3814bc92ba33a58a1591bf9151245116116a39908b7ef489b11bb186713d3381107f9b6dbfefa902318e3a226fff8bb21e89a2c24e6f79071e24dc247cf47020
-
SSDEEP
96:qdLrbESaXLwhIX7MtmO4/ZWshYFsqfMMEMG3yjGt6eXM96iX8r8ZfXFyxcZPEaKu:qdrCUGxTqfUfXYbXy8ZrG9lHO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4be438646c17ba410324f6a1257d260d_JaffaCakes118
Files
-
4be438646c17ba410324f6a1257d260d_JaffaCakes118.dll windows:4 windows x86 arch:x86
71fc229e9f567b13ed890ebee75546bc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FreeResource
SetEndOfFile
WriteFile
CreateFileA
LockResource
LoadResource
SizeofResource
OpenFile
ExpandEnvironmentStringsA
CopyFileA
DeleteFileA
FindResourceA
OpenProcess
SetFileAttributesA
CreateDirectoryA
Sleep
CreateThread
CreateToolhelp32Snapshot
Process32First
Process32Next
GetTempFileNameA
CloseHandle
user32
wsprintfA
advapi32
CreateProcessAsUserA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
OpenProcessToken
RegDeleteKeyA
shell32
StrCmpNIA
msvcrt
rename
??2@YAPAXI@Z
shlwapi
PathFileExistsA
Exports
Exports
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 416B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ