Static task
static1
Behavioral task
behavioral1
Sample
a0a4139b9634611044cd3c8d813ace2b_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a0a4139b9634611044cd3c8d813ace2b_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a0a4139b9634611044cd3c8d813ace2b_JaffaCakes118
-
Size
92KB
-
MD5
a0a4139b9634611044cd3c8d813ace2b
-
SHA1
52a6ea31bed98ba4f71311da9e631eda6e8231e8
-
SHA256
16cb72fa25c57fc8e017859a2509cd14f89438b1740efd41edb02e75de02ae90
-
SHA512
edd894998c16613571cc892f4d82041312c8deafbad9d5e153f7ff3e16a586686a7401e4e83533336f1f2b6eb57064801bcc0b899cbdcfaf31180a81d9fb5936
-
SSDEEP
1536:6Ps1Hxh30qeTqTscs8C1qURwy+UkIc/EZ4kmyvmLfyjpoEg7T+xz9Wf6bCm:3J0Qom9Ry+xItmkmyW2vg7Tlg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0a4139b9634611044cd3c8d813ace2b_JaffaCakes118
Files
-
a0a4139b9634611044cd3c8d813ace2b_JaffaCakes118.dll windows:4 windows x86 arch:x86
614b8902b3e3e4c37a2ed1f8cc385e38
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CreateNamedPipeW
ExitProcess
GetACP
GetCommandLineA
GetModuleHandleA
GetStartupInfoA
GetVersionExA
HeapAlloc
HeapCreate
ResetEvent
RtlUnwind
SizeofResource
Sleep
WinExec
lstrcpynW
user32
TrackPopupMenu
UpdateWindow
LoadMenuA
GetCapture
FrameRect
DrawIconEx
ClientToScreen
TrackPopupMenuEx
comctl32
ImageList_AddMasked
InitializeFlatSB
ImageList_Write
DrawStatusTextA
FlatSB_EnableScrollBar
FlatSB_SetScrollRange
GetMUILanguage
ImageList_SetFlags
ImageList_DragShowNolock
ole32
CoGetMalloc
CoTaskMemAlloc
CoTaskMemFree
CreateAntiMoniker
StringFromGUID2
CoFileTimeNow
CoCreateInstance
CoCreateGuid
CLSIDFromString
CoBuildVersion
dbghelp
SymLoadModule64
SymGetOptions
SymGetLinePrev64
SymGetModuleBase64
ImageNtHeader
ImageDirectoryEntryToData
FindExecutableImage
oleaut32
SysReAllocString
SafeArrayAllocDescriptor
SafeArrayAccessData
RevokeActiveObject
OleLoadPicturePath
Sections
.text Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ