CPlApplet
Behavioral task
behavioral1
Sample
fotos.dll
Resource
win7-20240704-en
General
-
Target
4cde324c494730c98d8c22a83fd19f0a_JaffaCakes118
-
Size
962KB
-
MD5
4cde324c494730c98d8c22a83fd19f0a
-
SHA1
7cb2f0f270e026719eb96d9b80fc26f043ce1b43
-
SHA256
938dee4a163e2b5f6a8edf4982dbf92a21d1108a867de1c298357eedb3bac0ca
-
SHA512
7a45f31ca832129b0ce4367b7c1d0bb17a6b5adafdc41a4d6573e0c256692cf5bd2f5feb7ee824133b4f33757941bd017464a000b90b33f8c3e6ac5aea5e7283
-
SSDEEP
24576:AZKI1U816IBWq24n4ZmZQXx61kRQ3gIHuK/2uQLp:O+wp3QXA1kRQ3xHHuRp
Malware Config
Signatures
-
resource yara_rule static1/unpack001/fotos.cpl themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/fotos.cpl
Files
-
4cde324c494730c98d8c22a83fd19f0a_JaffaCakes118.zip
-
fotos.cpl.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
Size: 302KB - Virtual size: 744KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 641KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE