Static task
static1
Behavioral task
behavioral1
Sample
a9b61e4f2b2d27a734112daaeecc2925_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
a9b61e4f2b2d27a734112daaeecc2925_JaffaCakes118
-
Size
112KB
-
MD5
a9b61e4f2b2d27a734112daaeecc2925
-
SHA1
cb1f047d25a61b2a4c455bfb9ee160dd5b393bcc
-
SHA256
e53d33d762dfff2c7bf195e7f48d5a8cf95f3686a5f54230c2fc43b3d6736868
-
SHA512
96f9952f18197c79800ff255b5a3b29c2cd3afa5440e5bb3c38b2086d99df9f5b5b516eaf5d905eb2ef9a05693ed152f0f8aab9f724713c2691889e79e7283b3
-
SSDEEP
3072:N10UxxXKM7SmRSOEAHnt7oyYv7Z3X6Q3TM+5jldzla5HS:N10UxxVdXWyYvVHRTM+7d45HS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a9b61e4f2b2d27a734112daaeecc2925_JaffaCakes118
Files
-
a9b61e4f2b2d27a734112daaeecc2925_JaffaCakes118.dll windows:4 windows x86 arch:x86
ad6c0ae44664c4d956992135685ee547
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedExchange
GetModuleFileNameA
GetProcAddress
GetVersion
GetStartupInfoA
VirtualAlloc
VirtualProtect
IsBadWritePtr
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
GetACP
GetVersionExA
Sleep
GetCurrentThreadId
GetLastError
GetProcessHeap
QueryPerformanceFrequency
user32
GetCursor
IsWindowUnicode
GetWindowRect
IsCharLowerA
IsCharUpperA
GetWindowRgn
GetWindowDC
WindowFromDC
GetForegroundWindow
CopyIcon
GetDlgItem
GetAncestor
GetWindow
GetLastActivePopup
IsIconic
IsWindowVisible
GetGUIThreadInfo
GetParent
GetDesktopWindow
IsChild
InSendMessage
advapi32
InitializeSecurityDescriptor
IsValidAcl
GetUserNameA
RevertToSelf
msvcrt
malloc
_initterm
free
memmove
_swab
_set_error_mode
rand
_CIsinh
_CIfmod
_CIacos
_itoa
_adjust_fdiv
ldiv
ceil
_pctype
_isctype
ldexp
__mb_cur_max
floor
div
_ltoa
gdi32
GdiFlush
GetROP2
GetBkColor
GetBkMode
GetBitmapDimensionEx
ole32
CoFileTimeNow
CoGetCurrentProcess
shell32
ord524
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 69KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ