CreateDatabaseSession
Static task
static1
Behavioral task
behavioral1
Sample
7905acd770572c169716f4304b10bb62_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7905acd770572c169716f4304b10bb62_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
7905acd770572c169716f4304b10bb62_JaffaCakes118
-
Size
64KB
-
MD5
7905acd770572c169716f4304b10bb62
-
SHA1
d991df6619d9b462cdb0c68db5ef452e353b076c
-
SHA256
14dc267afa1104ebded51953be1220ce00fe4c555dadcdf6637a1bb2439aaf29
-
SHA512
5f8c52d7cab93b74baff7f453a73853222fac35722176a574b467013504a8e3e6d3c2d7592fefc4eb8a1fbd473d363ae332797b84efc8f62168f63678f3d59c5
-
SSDEEP
768:cBC5KrwxvJgY7Fy+HthXdTavyAcQR5q9qfe59b0ou1mzeug61wk3lMaKJNIsWd:f00r7Fy+HthNu1ytLJzu61wk3lUfIxd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7905acd770572c169716f4304b10bb62_JaffaCakes118
Files
-
7905acd770572c169716f4304b10bb62_JaffaCakes118.dll windows:5 windows x86 arch:x86
2bfec0b356a144bdcd6750da1f089ffa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_BIND
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msnmetal
ord132
ord137
ord135
ord154
ord151
ord147
ord126
ord107
ord128
ord142
ord130
ord3
ord152
ord119
ord111
ord112
ord113
ord37
ord133
ord4
ord131
ord127
ord153
kernel32
CompareFileTime
MulDiv
CreateThread
CloseHandle
IsDBCSLeadByte
GetStringTypeExA
LocalReAlloc
LocalAlloc
lstrcmpA
DeleteCriticalSection
DisableThreadLibraryCalls
GetSystemInfo
InitializeCriticalSection
InterlockedIncrement
InterlockedDecrement
LeaveCriticalSection
WaitForSingleObject
lstrcmpiA
GetCurrentThreadId
EnterCriticalSection
SetEvent
GetCurrentProcessId
ReleaseMutex
HeapDestroy
HeapFree
UnmapViewOfFile
HeapCreate
FlushViewOfFile
HeapAlloc
lstrlenA
MapViewOfFile
GetLastError
SetEndOfFile
SetFilePointer
Sleep
lstrlenW
CreateFileMappingA
OpenFileMappingA
GetFileSize
GetDiskFreeSpaceA
WideCharToMultiByte
ole32
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
user32
CharUpperA
DestroyWindow
IsWindow
TranslateMessage
shlwapi
StrCmpW
StrStrA
StrStrIA
StrToIntExA
wnsprintfW
PathRenameExtensionW
PathFileExistsW
StrCmpIW
StrCpyNW
Exports
Exports
Sections
.text Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE