Static task
static1
Behavioral task
behavioral1
Sample
d155212e47a6087b2fd9ee13a16c7a1a_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d155212e47a6087b2fd9ee13a16c7a1a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d155212e47a6087b2fd9ee13a16c7a1a_JaffaCakes118
-
Size
459KB
-
MD5
d155212e47a6087b2fd9ee13a16c7a1a
-
SHA1
d14949e4cfd78385104acc76e8b01124ee58a83e
-
SHA256
95f38e693cf8b08f148403f700bc8a4d64e3158c2c0771c867fc24ea9fdcae25
-
SHA512
ca6fbd9108e5d13f5648904e696e205ec5ec5f1e6cd264ca37e895ab4e34c6d4e50de9be612206ae0a81400fc6ac745c200415eb4f26537a680665d6a690eb64
-
SSDEEP
12288:LMLM3F7BQSxXbz4AY3GUtKmI6LoIMFntYscMI/P:yM17WSxrz4P3GU8R6ctTcMI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d155212e47a6087b2fd9ee13a16c7a1a_JaffaCakes118
Files
-
d155212e47a6087b2fd9ee13a16c7a1a_JaffaCakes118.dll windows:4 windows x86 arch:x86
9a0a13edd732e583506aec6bace5f5c7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CopyFileA
DisableThreadLibraryCalls
EnumResourceLanguagesW
ExitProcess
GetACP
GetCommandLineA
GetModuleHandleA
GetOEMCP
GetStartupInfoA
GetVersion
HeapAlloc
LoadResource
MultiByteToWideChar
ReadFile
SetLastError
SetUnhandledExceptionFilter
VirtualAlloc
VirtualFree
lstrcpynA
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
ntdll
RtlFreeUnicodeString
RtlInitString
RtlInitUnicodeString
RtlLeaveCriticalSection
RtlNtStatusToDosError
RtlUnlockHeap
swprintf
wcsncpy
RtlEnterCriticalSection
RtlFreeSid
rpcrt4
I_UuidCreate
NdrFullPointerQueryPointer
NdrMesTypeAlignSize
NdrNonConformantStringBufferSize
I_RpcTransDatagramFree
NdrServerContextNewUnmarshall
NdrServerInitializeMarshall
NdrVaryingArrayUnmarshall
RpcServerRegisterIfEx
RpcServerTestCancel
RpcServerUseProtseqEpA
char_from_ndr
I_RpcTransDatagramAllocate2
NdrOleAllocate
crtdll
fseek
fputs
cos
_seterrormode
_memicmp
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 412KB - Virtual size: 987KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ