d:\over\JPFor\JP\Release\Dll.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5a2859bcc84f932d3e7f37bbf10fc7ff_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5a2859bcc84f932d3e7f37bbf10fc7ff_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5a2859bcc84f932d3e7f37bbf10fc7ff_JaffaCakes118
-
Size
19KB
-
MD5
5a2859bcc84f932d3e7f37bbf10fc7ff
-
SHA1
f102c72022068eaefb32b6cac0c60bce09244600
-
SHA256
271ae3e1b18ec7c034b4418dbff2bbeb6c713e0ffb6f568e267b8896ffdccc49
-
SHA512
f677d5bb132bee0d427448e03a11c7f262b491caaa85eec8ac146822f21837e458af47108fde17395ab10e30cd649df8957f5ede2e4c7453f3ba6f5b52f76ef2
-
SSDEEP
384:EyizcfrgqE8qbLdk1Fh5b3pd87SfHwuR9xkYWWbWXEHWqw9:Ey2urgqE8QmP5pd87SfHJRbkYWhE9w
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a2859bcc84f932d3e7f37bbf10fc7ff_JaffaCakes118
Files
-
5a2859bcc84f932d3e7f37bbf10fc7ff_JaffaCakes118.dll windows:4 windows x86 arch:x86
f4e16ae52a919707c8b9bae3fdfc8726
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CreateThread
CreateFileA
GetFileSize
SetEndOfFile
GetTickCount
WriteFile
ReadFile
FlushFileBuffers
VirtualProtect
DeleteFileA
CreateMutexW
SetFilePointer
CloseHandle
UnmapViewOfFile
GetDriveTypeA
FindFirstFileA
GetLastError
SetFileAttributesA
CreateFileMappingA
FindNextFileA
VirtualFree
VirtualAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleA
Sleep
MapViewOfFile
GetCurrentProcess
TerminateProcess
RtlUnwind
IsDebuggerPresent
user32
wsprintfA
advapi32
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
psapi
GetModuleFileNameExA
ws2_32
WSACleanup
htons
recv
connect
socket
closesocket
gethostbyname
WSAStartup
send
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ