Static task
static1
Behavioral task
behavioral1
Sample
a7c28c78216ab3340d81741b17638eba_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a7c28c78216ab3340d81741b17638eba_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a7c28c78216ab3340d81741b17638eba_JaffaCakes118
-
Size
53KB
-
MD5
a7c28c78216ab3340d81741b17638eba
-
SHA1
939dd8d70dfd007d618ccfe1c868053c2897984c
-
SHA256
5f87255517375185f53cfd088e340100a426f71966d994f3b12e020d46af1bc2
-
SHA512
f76a1d194ee6397b87ecdabce61f5d31532ea5449b84144e0cec7586ef620c94a8d491a0bedbb797d6c39ea271d2f206a75fcfef403204c569f898afb87ae038
-
SSDEEP
768:8vkc3PZFaqm9xemvsmmoHKq8G2FiOMFeW00Ofz:QZFe3vtqh6OMFeH0O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a7c28c78216ab3340d81741b17638eba_JaffaCakes118
Files
-
a7c28c78216ab3340d81741b17638eba_JaffaCakes118.dll windows:4 windows x86 arch:x86
fd36e211c5627b389aee6cd09ab5fb3f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntoskrnl.exe
ExRaiseException
ExInterlockedRemoveHeadList
ExFreePool
RtlDecompressBuffer
KeSetTimerEx
KeDelayExecutionThread
NtQuerySecurityObject
IoQueryFileInformation
ExAllocatePool
KeI386GetLid
KeInitializeTimerEx
PsInitialSystemProcess
KeInitializeDpc
IoGetFileObjectGenericMapping
RtlFindFirstRunClear
RtlFindLongestRunClear
ZwQuerySystemInformation
NtDuplicateToken
IoReportDetectedDevice
PfxInsertPrefix
KeSetTargetProcessorDpc
KeCancelTimer
atoi
ZwEnumerateValueKey
MmDisableModifiedWriteOfSection
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 832B - Virtual size: 832B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE