Static task
static1
Behavioral task
behavioral1
Sample
d489026b802de81e0125aa3103343e87_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d489026b802de81e0125aa3103343e87_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d489026b802de81e0125aa3103343e87_JaffaCakes118
-
Size
409KB
-
MD5
d489026b802de81e0125aa3103343e87
-
SHA1
f68aeabef269d664d93f938b0dd041232bf5ff47
-
SHA256
e0afac9a63d1b66e977d085a63125587222249923ff224c89ea8ccefefe1e312
-
SHA512
c4088bfba24fce12469bbfaeb523c2c3e809f34c23a832ab590d20804a09d9cb479be70a66f4774b21b7c2ed8c766baed3446cb5bb5cfb17f9b29eb7022a6adc
-
SSDEEP
12288:m6M9Wtq2fHR695yCFbQZoZ0JpMfMw41R0D6GNLS6npSxPdfyJdGSED+K+6:qNgR695yCFbXq1R05A6pS9d6Jsfb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d489026b802de81e0125aa3103343e87_JaffaCakes118
Files
-
d489026b802de81e0125aa3103343e87_JaffaCakes118.dll windows:4 windows x86 arch:x86
b833c8b9ef7c8f69ef4384881250a465
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
user32
GetKeyboardType
advapi32
RegQueryValueExA
oleaut32
SysFreeString
mpr
WNetGetConnectionA
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
CreateStreamOnHGlobal
comctl32
ImageList_SetIconSize
wininet
InternetGetConnectedState
urlmon
URLDownloadToFileA
Sections
CODE Size: 397KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE