abc
Static task
static1
Behavioral task
behavioral1
Sample
94186773abe136edb4d9e19210ee958c_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
94186773abe136edb4d9e19210ee958c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
94186773abe136edb4d9e19210ee958c_JaffaCakes118
-
Size
412KB
-
MD5
94186773abe136edb4d9e19210ee958c
-
SHA1
d29f6d10a9f0b64a89ac5734cf33001da1ea0405
-
SHA256
d383b2034e8d8f6c442f2ee1dcd1fc26b0fa35fc9e08fd0076601d95f88f6b99
-
SHA512
7dbd04904b9ad4dc2616e0e5d48d0bf9d5fb71fce010d3a9dc4fa56c900623e3093a3469d5c464eee603d0462fa0b4ebf2754258aaa8adb4395033eab9205256
-
SSDEEP
6144:bkxk9dmctoUlj7Z9N6Ub3gFpWPZooPNfQhIQfhwIzF1Kr+rhw6r+wk:wxcFhV+8SYhQ/qIzF1Gohwh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 94186773abe136edb4d9e19210ee958c_JaffaCakes118
Files
-
94186773abe136edb4d9e19210ee958c_JaffaCakes118.dll windows:4 windows x86 arch:x86
5b04fb7ccc9a5941766f3cc647d58924
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
shlwapi
SHEnumKeyExA
kernel32
OpenEventA
CreateFileMappingA
CreateNamedPipeA
DeleteAtom
DeleteFileA
DuplicateHandle
GetConsoleCP
GetExitCodeProcess
GetExitCodeThread
GetMailslotInfo
CloseHandle
GetModuleHandleA
GetNamedPipeInfo
GetProcessHeap
GetCurrentProcessId
GetStdHandle
GetCurrentThreadId
IsSystemResumeAutomatic
ReleaseMutex
ResetEvent
SetFilePointer
GetStartupInfoA
GetModuleFileNameA
GetBinaryTypeA
GetFileType
CancelIo
BackupRead
lstrcmpA
SetCurrentDirectoryA
GetDriveTypeW
GetWindowsDirectoryA
GetSystemDirectoryA
GetFileAttributesA
GetFileAttributesW
lstrcmpW
CreateDirectoryA
GetComputerNameA
user32
ReleaseDC
advapi32
GetUserNameW
GetUserNameA
msvcrt
malloc
free
winmm
timeEndPeriod
Exports
Exports
Sections
.code Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 356KB - Virtual size: 353KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
kdata Size: 4KB - Virtual size: 1B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 768B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ