Static task
static1
Behavioral task
behavioral1
Sample
5e17106469a186ee92aabc7bb3d0a76b_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5e17106469a186ee92aabc7bb3d0a76b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5e17106469a186ee92aabc7bb3d0a76b_JaffaCakes118
-
Size
135KB
-
MD5
5e17106469a186ee92aabc7bb3d0a76b
-
SHA1
0f26d41221d72a8fb0418a275fd029bdc14504b2
-
SHA256
69f42684f8f2882fe909a6e87e78c388fc1ec4fa1fc68974d65873cc9658a65d
-
SHA512
447ea239059f26d6f34931865c78d438026c1669c9ebfda784e0fed6cc132d378d5322bedbaa645bdf6e1a5fda1d280d5514f24ac140d63e703f6237c85c0dc3
-
SSDEEP
3072:T5WDxhYHlO7EDjUGJ0Bpj8dO4bYYoKxA8Z+Jp4142C4E+h:TQvYQ7ajUw0BWbbACsj2C4lh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e17106469a186ee92aabc7bb3d0a76b_JaffaCakes118
Files
-
5e17106469a186ee92aabc7bb3d0a76b_JaffaCakes118.dll windows:1 windows x86 arch:x86
648be15a44a7e791bae5f3437fbe4076
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntoskrnl.exe
strstr
_except_handler3
MmMapLockedPagesSpecifyCache
WmiQueryTrace
_wcsicmp
ZwQuerySystemInformation
ObReferenceObjectByHandle
KeI386GetLid
IoGetCurrentProcess
MmSizeOfMdl
wcsncpy
strncmp
SeCloseObjectAuditAlarm
FsRtlUninitializeLargeMcb
KeBugCheckEx
strncpy
RtlAnsiCharToUnicodeChar
KeTickCount
ExAllocatePoolWithTag
NtAdjustPrivilegesToken
FsRtlSyncVolumes
ObfReferenceObject
ExFreePoolWithTag
DbgPrint
KeQueryTimeIncrement
Sections
.data Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 672B - Virtual size: 650B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 768B - Virtual size: 750B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 192B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE