Static task
static1
Behavioral task
behavioral1
Sample
4963acf2be662c548b3df594bc9800e6_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4963acf2be662c548b3df594bc9800e6_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4963acf2be662c548b3df594bc9800e6_JaffaCakes118
-
Size
715KB
-
MD5
4963acf2be662c548b3df594bc9800e6
-
SHA1
c5dd90f219fbe1ccc87ea067e131fa3623dc41f8
-
SHA256
d04deb0d70961866240dccaa719df35552b58f53330fc3bf1915ea64ceddb338
-
SHA512
a4d5c1be892b39845a0585050b57e187debb3a0ca8f7de8176aefd3229d3aa795f3c15358acd415342641eb52c4cb4ab755c9f1bae6be809a4378bfdc2914db7
-
SSDEEP
12288:d5IfohAGcJ5SyNtTY9rFnKoaEBwGp2X9tziay:wghTcJ5zTY9rFnKhEBwV9tzid
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4963acf2be662c548b3df594bc9800e6_JaffaCakes118
Files
-
4963acf2be662c548b3df594bc9800e6_JaffaCakes118.dll windows:4 windows x86 arch:x86
7cc3f0a31253eb0a331d8b40f656592d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
rpcrt4
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
NdrDllGetClassObject
NdrOleFree
IUnknown_QueryInterface_Proxy
NdrDllCanUnloadNow
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrOleAllocate
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_AddRef
CStdStubBuffer_Invoke
kernel32
Sleep
ntdll
NtAdjustGroupsToken
NtAllocateVirtualMemory
Sections
.text Size: 404KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 35KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 240KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE