Static task
static1
Behavioral task
behavioral1
Sample
a6df1467437e6e6d2ece1e347e4f970c_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a6df1467437e6e6d2ece1e347e4f970c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a6df1467437e6e6d2ece1e347e4f970c_JaffaCakes118
-
Size
58KB
-
MD5
a6df1467437e6e6d2ece1e347e4f970c
-
SHA1
1590e84cbe11328a19e293e8ecf5714a4cc81e14
-
SHA256
9c002252ee0b5bd8e1bca9cd53db56c6a13142b0862f4e59663cffcb2363f2c2
-
SHA512
453dd84c376c5098dff19d09ef87a27d27cebe5cfefd68b70efae1ba34e96604a563468ae25eb2412741ef9fbe4aa4b4d65a6c24aa995478e37cc97c76d24b8a
-
SSDEEP
1536:l/Q5xLgNhT/M7pzLItjnRjoIOyKpv+auq5Y:anLqU7pKjRjgH+s5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a6df1467437e6e6d2ece1e347e4f970c_JaffaCakes118
Files
-
a6df1467437e6e6d2ece1e347e4f970c_JaffaCakes118.dll windows:4 windows x86 arch:x86
473680e3196b2171788321d42c7e20ff
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
LsaGetSystemAccessAccount
LsaCreateAccount
IsWellKnownSid
IsTextUnicode
EnumDependentServicesA
ConvertStringSidToSidA
kernel32
SetErrorMode
WriteConsoleA
TlsSetValue
TerminateProcess
SetPriorityClass
SetLastError
RtlUnwind
CloseHandle
DeleteCriticalSection
DisableThreadLibraryCalls
ExitProcess
ExitThread
ExpandEnvironmentStringsA
GetCommandLineA
GetCurrentThread
GetModuleHandleA
GetStartupInfoA
GetSystemInfo
GetVersionExA
GlobalAlloc
HeapAlloc
HeapCreate
HeapReAlloc
InterlockedDecrement
LocalAlloc
MultiByteToWideChar
security
RevertSecurityContext
AddSecurityPackageW
olepro32
OleCreatePropertyFrame
oleacc
GetRoleTextW
GetOleaccVersionInfo
CreateStdAccessibleObject
AccessibleObjectFromWindow
WindowFromAccessibleObject
setupapi
SetupDiGetDriverInfoDetailA
SetupOpenInfFileW
SetupQuerySpaceRequiredOnDriveA
SetupRemoveFromDiskSpaceListW
user32
RegisterClassExA
SetWindowPlacement
EnumChildWindows
Sections
.text Size: 46KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ