DllCanUnloadNow
Static task
static1
Behavioral task
behavioral1
Sample
af7f8bcb5c22f8f871dd151730529b85_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
af7f8bcb5c22f8f871dd151730529b85_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
af7f8bcb5c22f8f871dd151730529b85_JaffaCakes118
-
Size
28KB
-
MD5
af7f8bcb5c22f8f871dd151730529b85
-
SHA1
ed48b9c9877a34652a600c87717e0e3479670bfb
-
SHA256
19fb62cb98ad8f39fb0fb91e69bde1125ec1aa483948273830060b917ba8f848
-
SHA512
ac4ab35d72db33aa272b0cbd3f9cb50f3b532e3422f97b8e20f3ec69b7da11d33750a8d2c15b6580d234f0837797237af4189393294f1db1ce049ff134d22370
-
SSDEEP
384:+ptuXrxuKEnY41T2FUBMK8ml0o3EyZT6DUoKrHv:ueuHrT2uBUAT6goKrP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource af7f8bcb5c22f8f871dd151730529b85_JaffaCakes118
Files
-
af7f8bcb5c22f8f871dd151730529b85_JaffaCakes118.dll windows:4 windows x86 arch:x86
caab53d9faacceef1714e421980eeb9c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleFileNameA
GetSystemDirectoryA
CopyFileA
GetCommandLineA
GetVersion
GetCPInfo
GetACP
GetOEMCP
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
GetStringTypeA
GetStringTypeW
HeapAlloc
RtlUnwind
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
advapi32
RegOpenKeyExA
RegSetValueExA
Exports
Exports
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ