Static task
static1
Behavioral task
behavioral1
Sample
b39b8dfb162ae0eb3982ea865c3c9139_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b39b8dfb162ae0eb3982ea865c3c9139_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b39b8dfb162ae0eb3982ea865c3c9139_JaffaCakes118
-
Size
124KB
-
MD5
b39b8dfb162ae0eb3982ea865c3c9139
-
SHA1
f9fdc3108208e08caa63e30f9eb55cf3b8306709
-
SHA256
833ab8c23a40efee107ffc4bf6f22760db2b43a1ab66d5598ef8e92bf7e0b916
-
SHA512
c10b058c509e6bcb78b933e39141212869a6fe2e3f1b04110f432d3d2391c94fcbccdbb897a552c0328f3cfee61286f4bbff1eece139ff2323812335a7be9843
-
SSDEEP
3072:FmOMgKBlUquw+MnowMqqDLy/sOcWKCdzue757HG:PMgiUbHqqDLusOXd+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b39b8dfb162ae0eb3982ea865c3c9139_JaffaCakes118
Files
-
b39b8dfb162ae0eb3982ea865c3c9139_JaffaCakes118.dll windows:4 windows x86 arch:x86
57f650c3d893e2c2ce6685a122997088
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCommandLineA
VirtualProtect
CloseHandle
LocalFree
LocalAlloc
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
DisableThreadLibraryCalls
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetProcAddress
LoadLibraryW
GetStringTypeExW
GetTimeFormatW
GetProcessHeap
UnmapViewOfFile
RtlUnwind
GetVersion
ExitProcess
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
HeapAlloc
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ