Static task
static1
Behavioral task
behavioral1
Sample
af0928970e766eb280d9b1394f9c9c68_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
af0928970e766eb280d9b1394f9c9c68_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
af0928970e766eb280d9b1394f9c9c68_JaffaCakes118
-
Size
51KB
-
MD5
af0928970e766eb280d9b1394f9c9c68
-
SHA1
9faef24504470bf077bdf070ebbd72953d722492
-
SHA256
a5d19637b22148401613397ff7d23ee5fe2c06803d89d135257d29e04a9cd80f
-
SHA512
e88bc630cea8a8d637e595cfe4d7a38b206f9273f06509c15edef437dd16912e9775f0fb1f798579f8b531c1ca18cdefbc5fd3adcd9f9c398b4a440bd9cb25c6
-
SSDEEP
1536:oeNJtEUfQGLad9dU422Y+QNB8oAAimFn7+eyaHlL:oevtvfQJnYNjimFqepHF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource af0928970e766eb280d9b1394f9c9c68_JaffaCakes118
Files
-
af0928970e766eb280d9b1394f9c9c68_JaffaCakes118.dll windows:4 windows x86 arch:x86
de6d860f1ec4159811b58c1aa3aa4621
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
RtlZeroMemory
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
ReadFile
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
LoadLibraryA
HeapReAlloc
HeapFree
HeapAlloc
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVersionExA
GetProcessHeap
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetModuleFileNameA
GetFullPathNameA
GetFileSize
FindNextFileA
FindFirstFileA
FindClose
FindAtomA
ExitThread
DeleteAtom
CreateThread
CreateFileA
CloseHandle
WideCharToMultiByte
AddAtomA
advapi32
RegQueryValueExA
RegOpenKeyA
RegEnumKeyExA
RegCloseKey
CryptReleaseContext
CryptHashData
CryptDestroyKey
CryptDestroyHash
CryptDeriveKey
CryptDecrypt
CryptCreateHash
CryptAcquireContextW
user32
CharUpperA
Sections
.text Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ