DecryptBase
Static task
static1
Behavioral task
behavioral1
Sample
8e302eb43221ab2cbdc46cd8527e99b7_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8e302eb43221ab2cbdc46cd8527e99b7_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8e302eb43221ab2cbdc46cd8527e99b7_JaffaCakes118
-
Size
9KB
-
MD5
8e302eb43221ab2cbdc46cd8527e99b7
-
SHA1
0fc3c3fe0c15725e949e4bbe39fc7115cb59adb2
-
SHA256
0e062299c0b1cb1cf368a25e41e6ce9cbe76d6b05eb3a64de2e414b805db2bf5
-
SHA512
c86ee72d40193e77432003eb290bacc7b8e9ad885af9b47a976c5a146e1ef839200062cb10455a7d7348edb3d45d09cc2c34ca459c6d1abadc9a2f7d85a314b5
-
SSDEEP
192:F+6quSo4w3t3X0d2zMQ03X7Wr6Ckpb/nR:F+i4gzMdrWr69zR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e302eb43221ab2cbdc46cd8527e99b7_JaffaCakes118
Files
-
8e302eb43221ab2cbdc46cd8527e99b7_JaffaCakes118.dll windows:4 windows x86 arch:x86
e11efa419a22daddc1181992b8caa3a0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcr80
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
memset
kernel32
lstrlenA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleFileNameA
LoadLibraryA
GetProcAddress
CreateProcessA
Exports
Exports
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.members Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 494B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ