ATRTrapInstanceCreate
Static task
static1
Behavioral task
behavioral1
Sample
bad150887e0400ffc3bf684f916220cc_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
bad150887e0400ffc3bf684f916220cc_JaffaCakes118
-
Size
612KB
-
MD5
bad150887e0400ffc3bf684f916220cc
-
SHA1
be36a11c07762191a7f32ce177259ac87bea27ba
-
SHA256
7ff0eb7a3a5176e5c5da915b4afa9ff971b70eced64bfef705ab53b72a683e15
-
SHA512
e86b810446bec1cfbfda729a943e04c2a783315bf37c1701e0e50fceb2db59d92d2228691f284939e6d76e2a8ac6a7ad12a9b148cd3ec767c11c4d9e1fc0ddfd
-
SSDEEP
12288:tqaWyV3Og4SE2cH6pKPv7bOZD1u3yqOh23MxMj5wzFUh4DAaHECASQoQWS:tZxV3OgTEpZbyo0s4DrHYSWWS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bad150887e0400ffc3bf684f916220cc_JaffaCakes118
Files
-
bad150887e0400ffc3bf684f916220cc_JaffaCakes118.dll windows:4 windows x86 arch:x86
124e9c1ab19c56b02c367ce45388396b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcr80
_CIatan2
_CIcos
bsearch
rand
abort
getenv
__iob_func
vsprintf
memmove
_encode_pointer
_malloc_crt
free
_encoded_null
_CIsin
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_CIasin
_CIlog10
_CIpow
qsort
_CIfmod
sscanf
exit
longjmp
_CIsqrt
floor
ceil
memcpy
_setjmp3
_decode_pointer
memset
kernel32
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
Exports
Exports
Sections
.text Size: 448KB - Virtual size: 446KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE