Static task
static1
Behavioral task
behavioral1
Sample
4dde3d33cebb651af0267ce35cd38619_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4dde3d33cebb651af0267ce35cd38619_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4dde3d33cebb651af0267ce35cd38619_JaffaCakes118
-
Size
104KB
-
MD5
4dde3d33cebb651af0267ce35cd38619
-
SHA1
8f43ae411b10df86781747ac5d7bbc6c24f3cbdc
-
SHA256
1bddf52e6812c1d16a0ece70661602f59bedb879727183404e530060d16052a2
-
SHA512
5aacf017709875b952cf7f14ece09b39cc2faca9b3d8e16e31ab97f17c46702488a0153e33eb78e10ddb315e9976a443dac17b14c3cd06a79003b9df6e23750f
-
SSDEEP
3072:b6i4H2T1UIGHdFGerHlDJzQjoSreLnJwfng:qWT1UIG3JHkogGnJw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4dde3d33cebb651af0267ce35cd38619_JaffaCakes118
Files
-
4dde3d33cebb651af0267ce35cd38619_JaffaCakes118.dll windows:4 windows x86 arch:x86
699db164ef5f973d5945b889ad8afba0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
netapi32
Netbios
NetScheduleJobAdd
NetReplGetInfo
DsRoleCancel
advapi32
ElfReportEventA
GetExplicitEntriesFromAclW
LsaICLookupSids
ElfDeregisterEventSource
ObjectPrivilegeAuditAlarmA
QueryServiceLockStatusA
AllocateAndInitializeSid
ConvertSecurityDescriptorToStringSecurityDescriptorA
RemoveTraceCallback
user32
GetPropA
GetSubMenu
GetSysColorBrush
LoadImageA
MsgWaitForMultipleObjects
SendMessageTimeoutA
SetClipboardData
EnableMenuItem
shlwapi
PathQuoteSpacesA
PathParseIconLocationW
PathMakePrettyW
PathIsPrefixA
PathIsFileSpecA
PathGetArgsA
PathFindSuffixArrayW
PathCanonicalizeW
AssocQueryKeyW
oleaut32
VarBstrCat
SafeArrayCreate
RevokeActiveObject
ClearCustData
OleLoadPicturePath
RegisterTypeLi
kernel32
GetVersionExA
CreateFileA
ExitProcess
FileTimeToSystemTime
GetBinaryTypeA
WriteFile
WaitForSingleObjectEx
VirtualQueryEx
MoveFileWithProgressA
LocalFlags
LocalFileTimeToFileTime
IsBadHugeReadPtr
HeapCreate
HeapAlloc
CloseHandle
GetSystemWindowsDirectoryW
GetStartupInfoA
GetProfileIntW
GetProcessShutdownParameters
GetModuleHandleA
GetLogicalDriveStringsA
GetFullPathNameW
GetCompressedFileSizeW
GetCommandLineA
dbghelp
ImageRvaToSection
SymEnumTypes
SymGetSymFromAddr
SymSetOptions
SymUnDName
SymGetLineFromName
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_winoc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ