Static task
static1
Behavioral task
behavioral1
Sample
bead05e68dbc9e01c1357a80e0453429_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bead05e68dbc9e01c1357a80e0453429_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bead05e68dbc9e01c1357a80e0453429_JaffaCakes118
-
Size
84KB
-
MD5
bead05e68dbc9e01c1357a80e0453429
-
SHA1
9bb693db9ad7865ddd2c4c3b9a617182f0f6aa46
-
SHA256
01469d6877368603c1e4b1210c5a6ff2cf519ebacb1749917652853bcaa3d76a
-
SHA512
cd820d34170499f1066fd004c5ba4eac78cc744bb1414665a2fd96ce76a8a28a8dc77afb81b0585a356dbd63bea9571777abc60fc72579b89b915e65b3135ae4
-
SSDEEP
384:wsUrfR5x8RFPnEWtcV2cYwheoPo7RxWGcx:wh5anXCV2LwhbgtS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bead05e68dbc9e01c1357a80e0453429_JaffaCakes118
Files
-
bead05e68dbc9e01c1357a80e0453429_JaffaCakes118.dll windows:4 windows x86 arch:x86
f90ec498a72f2b4f3bae3e773f3594d5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord800
ord2764
ord3262
ord860
ord540
ord535
ord3953
ord1176
ord1575
ord1168
ord1116
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord1089
ord5199
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4202
ord4274
ord269
ord826
ord600
ord1578
ord6467
msvcrt
??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
_mbscmp
__CxxFrameHandler
??2@YAPAXI@Z
kernel32
LocalFree
CopyFileA
FindFirstFileA
GetWindowsDirectoryA
GetModuleHandleA
LoadLibraryA
OutputDebugStringA
Module32First
Module32Next
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
LocalAlloc
advapi32
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
Sections
.minCtr1 Size: 4KB - Virtual size: 112B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.minCtr1 Size: 4KB - Virtual size: 208B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.minCtr1 Size: 4KB - Virtual size: 304B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.minCtr1 Size: 4KB - Virtual size: 240B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.minCtr1 Size: 4KB - Virtual size: 48B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.minCtr2 Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.minCtr1 Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.minCtr2 Size: 4KB - Virtual size: 192B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.mtinCtr Size: 4KB - Virtual size: 272B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.minCtr2 Size: 4KB - Virtual size: 272B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.minCtr3 Size: 4KB - Virtual size: 80B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.minCtr2 Size: 4KB - Virtual size: 304B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.minCtr2 Size: 4KB - Virtual size: 384B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.minCtr2 Size: 4KB - Virtual size: 128B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.mintry1 Size: 4KB - Virtual size: 528B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 930B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ