Static task
static1
Behavioral task
behavioral1
Sample
683e37ea73f92ce8d87c491bde89554b_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
683e37ea73f92ce8d87c491bde89554b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
683e37ea73f92ce8d87c491bde89554b_JaffaCakes118
-
Size
36KB
-
MD5
683e37ea73f92ce8d87c491bde89554b
-
SHA1
9d8b6f4eba025c134744e81478fdf6cf29c1b3bf
-
SHA256
6203723c607330d7f08d1d9417f2234ff159108dd3c5ad720683429d9a5d854a
-
SHA512
d9f0797c57b410edf748408bf4e16b920344aeadac679b433a0331ee04caf32125f4de9f1d6ef87e38aecc131753943ed9ba6cff5c4378e256685ea732c32bbc
-
SSDEEP
384:Sp+dlEkSPqeRWvTTb92B/fS2mllrf5yMb3FNJ7tQchvaoOvf4kpg:Sp+jTLTbItfO3vFaoOvbp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 683e37ea73f92ce8d87c491bde89554b_JaffaCakes118
Files
-
683e37ea73f92ce8d87c491bde89554b_JaffaCakes118.dll windows:4 windows x86 arch:x86
1acad2eaf2bd713b30c9f2800df0131d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
GetModuleHandleA
CreateThread
GetStringTypeA
LCMapStringW
lstrcmpA
GetProcAddress
DisableThreadLibraryCalls
RtlUnwind
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
HeapAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
LCMapStringA
GetStringTypeW
user32
MessageBoxA
advapi32
GetUserNameA
Sections
.text Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ