Static task
static1
Behavioral task
behavioral1
Sample
bea6fdbbee703d5f568dd4b1fada6e7b_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bea6fdbbee703d5f568dd4b1fada6e7b_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bea6fdbbee703d5f568dd4b1fada6e7b_JaffaCakes118
-
Size
61KB
-
MD5
bea6fdbbee703d5f568dd4b1fada6e7b
-
SHA1
41eb3339f650bfc3f42d7abecfaac0abf1e78245
-
SHA256
6d3a9d339620a03d39b9ef50726fdf91b85ba867b67b6d84583dafb0b6494097
-
SHA512
d12e20cffc61e9dc518562d1b6b8f0bbdf3c5cc7f26c6d3fe61eca8dae0474c166e259c2d9a96c6f4a96ae2b32e5f2d0f3e4fa4cbe4b96c1d8331d30a7923f71
-
SSDEEP
1536:R0UDIgo9KEvnkFItL4Jgz/tZyxOfi48hbmIC/hAm:09fnkFCqi/+ci4UbmICKm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bea6fdbbee703d5f568dd4b1fada6e7b_JaffaCakes118
Files
-
bea6fdbbee703d5f568dd4b1fada6e7b_JaffaCakes118.dll windows:4 windows x86 arch:x86
e5845586619cd590492166aa65d93858
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WideCharToMultiByte
GetLastError
MultiByteToWideChar
IsValidCodePage
GlobalFree
InterlockedExchange
InterlockedCompareExchange
GlobalAlloc
DisableThreadLibraryCalls
LeaveCriticalSection
EnterCriticalSection
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersion
VirtualProtect
GetCommandLineA
Sleep
user32
GetWindowLongW
SetWindowLongW
gdi32
SetWindowOrgEx
DeleteDC
ExtTextOutW
TranslateCharsetInfo
GetObjectType
GetTextCharacterExtra
GetLayout
GetTextAlign
SetTextAlign
SetViewportExtEx
SetWindowExtEx
SetViewportOrgEx
SetMapMode
GetGlyphIndicesW
SelectObject
DeleteObject
rpcrt4
NdrDllGetClassObject
msvcrt
malloc
_XcptFilter
_amsg_exit
__CxxFrameHandler
_except_handler3
free
_initterm
_adjust_fdiv
qsort
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ