Static task
static1
Behavioral task
behavioral1
Sample
a61bb611ab77e5bb2d3cab672392a928_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
a61bb611ab77e5bb2d3cab672392a928_JaffaCakes118
-
Size
160KB
-
MD5
a61bb611ab77e5bb2d3cab672392a928
-
SHA1
0d96f0c3acceee87c542dcc9bcf56401872d89bb
-
SHA256
779b0b38e2c4600ab7cd5f80b5a96c09ee9cc21b4b088d63f929428bde54ab4e
-
SHA512
47e32d6fa6c4d6813964cc52b649f8416a12c6f17ba7cc677a834916d4e22d3eb17e938c88e8656701dcbe43edff951df4c135175e4b07e992419ebb51a5ad3b
-
SSDEEP
3072:pHNhHzNaPMmRsZTPjNeq8hfMsV60HixKF+/C9yHC5ta0mk5Rx1:pPHZa98TxE8A+/GyHCRmUH1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a61bb611ab77e5bb2d3cab672392a928_JaffaCakes118
Files
-
a61bb611ab77e5bb2d3cab672392a928_JaffaCakes118.dll windows:4 windows x86 arch:x86
73e65d0e64dc9899e4cb37e6e899f4b1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedExchange
GetProcAddress
GetVersion
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetLocalTime
VirtualAlloc
VirtualProtect
VirtualQuery
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
LoadLibraryA
Sleep
IsDebuggerPresent
SetLastError
GetLastError
GetProcessHeap
GetCurrentThreadId
user32
GetCursor
IsWindowUnicode
GetClientRect
GetWindowTextLengthA
IsCharAlphaNumericA
IsClipboardFormatAvailable
GetDC
WindowFromDC
GetIconInfo
CopyIcon
GetAncestor
GetWindow
GetTopWindow
IsZoomed
IsIconic
GetGUIThreadInfo
GetParent
GetDesktopWindow
InSendMessage
IsMenu
IsChild
advapi32
InitializeSecurityDescriptor
IsValidAcl
GetUserNameA
RevertToSelf
msvcrt
_adjust_fdiv
malloc
_initterm
free
memmove
_swab
_memccpy
_ultoa
srand
_set_error_mode
_errno
_CIpow
_itoa
ldiv
time
ldexp
ceil
_pctype
_isctype
__mb_cur_max
rand
gdi32
GetStretchBltMode
GdiGetBatchLimit
GetROP2
GetBkColor
ole32
CoFileTimeNow
CoGetCurrentProcess
shell32
ord66
DuplicateIcon
ord524
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 61KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ