Static task
static1
Behavioral task
behavioral1
Sample
b0a02598aca057cae69a4f3264e30b85_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b0a02598aca057cae69a4f3264e30b85_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b0a02598aca057cae69a4f3264e30b85_JaffaCakes118
-
Size
104KB
-
MD5
b0a02598aca057cae69a4f3264e30b85
-
SHA1
cc45196b13ee43b5a32aea4e345bced30fec86e5
-
SHA256
0bf7478ca4cab50b8dd26ff8005ddf8bc3be0655fdea3c579352b373e2e4af7b
-
SHA512
10c6ec28793c6946ab1741b8e42205df6adca565ba17ad7a41e2455067b502b9c7b9cc015be407f3f58f9ad592268f930ca41a5b81573e1e095e8d174f55c8c0
-
SSDEEP
3072:Dsw5Y1RBpcdYNZQYPMEHZcjbEaNTDIdWmxDIDF38HM:DswcBm6QYBCjbEETkGpg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b0a02598aca057cae69a4f3264e30b85_JaffaCakes118
Files
-
b0a02598aca057cae69a4f3264e30b85_JaffaCakes118.dll windows:4 windows x86 arch:x86
699db164ef5f973d5945b889ad8afba0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
netapi32
Netbios
NetScheduleJobAdd
NetReplGetInfo
DsRoleCancel
advapi32
ElfReportEventA
GetExplicitEntriesFromAclW
LsaICLookupSids
ElfDeregisterEventSource
ObjectPrivilegeAuditAlarmA
QueryServiceLockStatusA
AllocateAndInitializeSid
ConvertSecurityDescriptorToStringSecurityDescriptorA
RemoveTraceCallback
user32
GetPropA
GetSubMenu
GetSysColorBrush
LoadImageA
MsgWaitForMultipleObjects
SendMessageTimeoutA
SetClipboardData
EnableMenuItem
shlwapi
PathQuoteSpacesA
PathParseIconLocationW
PathMakePrettyW
PathIsPrefixA
PathIsFileSpecA
PathGetArgsA
PathFindSuffixArrayW
PathCanonicalizeW
AssocQueryKeyW
oleaut32
VarBstrCat
SafeArrayCreate
RevokeActiveObject
ClearCustData
OleLoadPicturePath
RegisterTypeLi
kernel32
GetVersionExA
CreateFileA
ExitProcess
FileTimeToSystemTime
GetBinaryTypeA
WriteFile
WaitForSingleObjectEx
VirtualQueryEx
MoveFileWithProgressA
LocalFlags
LocalFileTimeToFileTime
IsBadHugeReadPtr
HeapCreate
HeapAlloc
CloseHandle
GetSystemWindowsDirectoryW
GetStartupInfoA
GetProfileIntW
GetProcessShutdownParameters
GetModuleHandleA
GetLogicalDriveStringsA
GetFullPathNameW
GetCompressedFileSizeW
GetCommandLineA
dbghelp
ImageRvaToSection
SymEnumTypes
SymGetSymFromAddr
SymSetOptions
SymUnDName
SymGetLineFromName
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ