Static task
static1
Behavioral task
behavioral1
Sample
4b622445424e90102ec45d6dcf2db956_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4b622445424e90102ec45d6dcf2db956_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4b622445424e90102ec45d6dcf2db956_JaffaCakes118
-
Size
460KB
-
MD5
4b622445424e90102ec45d6dcf2db956
-
SHA1
67f0fd7a7c4db858b7cc5fb21c6a69a18bcd3cd1
-
SHA256
c24fbb57ccfcf281e39f53c68b8cd53beaaba26a6ceccf9ac7710cd804e233d3
-
SHA512
1b6e4acf80b9df8bb0e77dcaa03bfbf6860ed93d1d8423c04767ae3bc40156aab3a2065cd1630ad40b5610fd3ecc24f2f2411b3cefd9a677a914e7673fc83ef1
-
SSDEEP
6144:KgWc5DC/Wg4YCMcb46I6i9egZ/j+LNX+Cic5i212GguUJ0bAhEoLD68/qcT2:Nb0/b4YWLmegZyLNOQ0rL0shE+D6tcC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b622445424e90102ec45d6dcf2db956_JaffaCakes118
Files
-
4b622445424e90102ec45d6dcf2db956_JaffaCakes118.dll windows:4 windows x86 arch:x86
9a0a13edd732e583506aec6bace5f5c7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CopyFileA
DisableThreadLibraryCalls
EnumResourceLanguagesW
ExitProcess
GetACP
GetCommandLineA
GetModuleHandleA
GetOEMCP
GetStartupInfoA
GetVersion
HeapAlloc
LoadResource
MultiByteToWideChar
ReadFile
SetLastError
SetUnhandledExceptionFilter
VirtualAlloc
VirtualFree
lstrcpynA
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
ntdll
RtlFreeUnicodeString
RtlInitString
RtlInitUnicodeString
RtlLeaveCriticalSection
RtlNtStatusToDosError
RtlUnlockHeap
swprintf
wcsncpy
RtlEnterCriticalSection
RtlFreeSid
rpcrt4
I_UuidCreate
NdrFullPointerQueryPointer
NdrMesTypeAlignSize
NdrNonConformantStringBufferSize
I_RpcTransDatagramFree
NdrServerContextNewUnmarshall
NdrServerInitializeMarshall
NdrVaryingArrayUnmarshall
RpcServerRegisterIfEx
RpcServerTestCancel
RpcServerUseProtseqEpA
char_from_ndr
I_RpcTransDatagramAllocate2
NdrOleAllocate
crtdll
fseek
fputs
cos
_seterrormode
_memicmp
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 412KB - Virtual size: 987KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ