Static task
static1
Behavioral task
behavioral1
Sample
ae23c4cffe405a349740555bd947c4e9_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ae23c4cffe405a349740555bd947c4e9_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ae23c4cffe405a349740555bd947c4e9_JaffaCakes118
-
Size
459KB
-
MD5
ae23c4cffe405a349740555bd947c4e9
-
SHA1
f2a0a4c9bbf10d02648a23a1204d509eb4c2cbfc
-
SHA256
efd5613cba83547463c4742d6753a386eec7d9169fefcffe8bb5b8c82704b9d7
-
SHA512
34f5dcc7c3e71061d0007b203a1093a3e4bbc9bb784661625b48438a89d180b2ceaf90e462c6b33aafc6d3e131c1ce5a809ae21883c0042c5d04cadbcdb7beac
-
SSDEEP
12288:WzeiZEIEvFBdq5VhsIia0TUq09pfbJrHHLDCw:WaiZxEvFBg5Vfj+Uq09pD5G
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae23c4cffe405a349740555bd947c4e9_JaffaCakes118
Files
-
ae23c4cffe405a349740555bd947c4e9_JaffaCakes118.dll windows:4 windows x86 arch:x86
9a0a13edd732e583506aec6bace5f5c7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CopyFileA
DisableThreadLibraryCalls
EnumResourceLanguagesW
ExitProcess
GetACP
GetCommandLineA
GetModuleHandleA
GetOEMCP
GetStartupInfoA
GetVersion
HeapAlloc
LoadResource
MultiByteToWideChar
ReadFile
SetLastError
SetUnhandledExceptionFilter
VirtualAlloc
VirtualFree
lstrcpynA
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
ntdll
RtlFreeUnicodeString
RtlInitString
RtlInitUnicodeString
RtlLeaveCriticalSection
RtlNtStatusToDosError
RtlUnlockHeap
swprintf
wcsncpy
RtlEnterCriticalSection
RtlFreeSid
rpcrt4
I_UuidCreate
NdrFullPointerQueryPointer
NdrMesTypeAlignSize
NdrNonConformantStringBufferSize
I_RpcTransDatagramFree
NdrServerContextNewUnmarshall
NdrServerInitializeMarshall
NdrVaryingArrayUnmarshall
RpcServerRegisterIfEx
RpcServerTestCancel
RpcServerUseProtseqEpA
char_from_ndr
I_RpcTransDatagramAllocate2
NdrOleAllocate
crtdll
fseek
fputs
cos
_seterrormode
_memicmp
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 412KB - Virtual size: 987KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ