Static task
static1
Behavioral task
behavioral1
Sample
bba6c7ad7b83f1985899f6b9f3a0a115_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bba6c7ad7b83f1985899f6b9f3a0a115_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bba6c7ad7b83f1985899f6b9f3a0a115_JaffaCakes118
-
Size
479KB
-
MD5
bba6c7ad7b83f1985899f6b9f3a0a115
-
SHA1
8472f3aa83acce06998e5ecd80ea2449440918a2
-
SHA256
34dbb41ce7b8b02055e8925c3062e3d9ade9507c5960d8270e8380efe6ea0275
-
SHA512
8e663cbde2b41906cc81c602f1570f67d3a37e15f3958bdf099d4b40ecba0f7414033e96b75fb4033229b3784abb9eb4e69c625e2247c4a06bd5df518f3ce5bb
-
SSDEEP
6144:4+9tbj6EEkk8b2AbOdFlwGiKG5UwqpD+AwNhDpmYWspDeMdmihTprQ4Il0K3an:rDjEjwEG5UrpIh1bWs9hTe4Ilfa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bba6c7ad7b83f1985899f6b9f3a0a115_JaffaCakes118
Files
-
bba6c7ad7b83f1985899f6b9f3a0a115_JaffaCakes118.dll windows:4 windows x86 arch:x86
380b64b96a55dc5545f6fa10a7327a1a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
crtdll
wctomb
wcsstr
wcscoll
vprintf
strncmp
sin
rename
mktime
malloc
iswupper
isalnum
fsetpos
fgets
fabs
_ungetch
_tzset
_strcmpi
_stat
_spawnv
_mbsnicmp
_CIcos
_mbsncmp
_mbsnbcpy
_mbccpy
_matherr
_ltoa
_locking
_hypot
_heapmin
_getpid
_getcwd
_finite
_exit
__toascii
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
rpcrt4
char_from_ndr
UuidFromStringA
UuidCreateSequential
RpcStringBindingComposeA
RpcSsGetContextBinding
RpcSsEnableAllocate
RpcSmSetClientAllocFree
RpcSmEnableAllocate
RpcServerUseProtseqA
RpcServerTestCancel
RpcServerRegisterIf
RpcServerListen
RpcServerInqDefaultPrincNameA
RpcObjectSetType
RpcObjectInqType
RpcMgmtSetCancelTimeout
RpcMgmtEpEltInqNextA
RpcIfInqId
RpcIfIdVectorFree
RpcBindingSetAuthInfoExA
RpcBindingInqOption
MesEncodeIncrementalHandleCreate
DceErrorInqTextA
RpcServerYield
ntdll
RtlNtStatusToDosError
RtlLeaveCriticalSection
RtlCopyLuid
NtWriteVirtualMemory
kernel32
CompareStringA
EnterCriticalSection
EnumResourceLanguagesW
EnumResourceTypesA
ExitProcess
FindResourceA
GetACP
GetCommandLineA
GetDateFormatA
GetModuleHandleA
GetOEMCP
GetPrivateProfileStringA
GetStartupInfoA
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetVersionExA
HeapAlloc
LeaveCriticalSection
LoadLibraryA
RaiseException
ReadFile
SetCurrentDirectoryA
SetEndOfFile
SetLastError
SetUnhandledExceptionFilter
TlsFree
TlsSetValue
VirtualAlloc
VirtualFree
lstrcpyA
lstrcpynA
lstrlenA
CloseHandle
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 415KB - Virtual size: 987KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ