Behavioral task
behavioral1
Sample
9730243830f7abb7624ea745994b2480_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
9730243830f7abb7624ea745994b2480_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
9730243830f7abb7624ea745994b2480_JaffaCakes118
-
Size
1.4MB
-
MD5
9730243830f7abb7624ea745994b2480
-
SHA1
c2f205c29e22d8fd7a5f10eb78596c8cbbec9cf8
-
SHA256
31f5ed2b92ca3089369502713b12c608137c3bd5fa9ee7d15a5295dc43963b64
-
SHA512
898cd5e662a448e30cd0fa22a00e54564d6f949d24b8b6a14a931fa981c9df57794132aff3b9bb638f49d3e5f05e55602479da58a8ef857fd66bcaba413e01ad
-
SSDEEP
24576:0+q77bsphPQil6bRge5ey5aFTmboyRSpg6vMwie+iXh+8yc:0+qzsphPQK6bX5N5aAwpwkBy
Malware Config
Signatures
-
Mimikatz family
-
mimikatz is an open source tool to dump credentials on Windows 1 IoCs
resource yara_rule sample mimikatz -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9730243830f7abb7624ea745994b2480_JaffaCakes118
Files
-
9730243830f7abb7624ea745994b2480_JaffaCakes118.dll windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: 885KB - Virtual size: 885KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 457KB - Virtual size: 457KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ