Static task
static1
Behavioral task
behavioral1
Sample
d48eb475062aa50a658bb16c39f486a2_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d48eb475062aa50a658bb16c39f486a2_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d48eb475062aa50a658bb16c39f486a2_JaffaCakes118
-
Size
90KB
-
MD5
d48eb475062aa50a658bb16c39f486a2
-
SHA1
db2a9089ed70e5c82a2a8a50eb6587b7a2d64cd1
-
SHA256
e4ce8a95cff3ac0b38ce0f916853d10c76949b5cf7aaf90adca7d203707d2e75
-
SHA512
f397108065b64a4b0abc95f2e9239a6e89e5109718233143c55afd924a61e2a040d97f4781d15170733b02ed5a09a09854d54ab1f5a4e9b4a24e821a7a395c62
-
SSDEEP
1536:oZldIeNZYci//gNQw9m8VCduy7ndHO04ZUaZyJ2juF+4i+JXGwLKJR6y:oZldDNpiXgBmKqhP4ZUaZyJ2ju+6636y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d48eb475062aa50a658bb16c39f486a2_JaffaCakes118
Files
-
d48eb475062aa50a658bb16c39f486a2_JaffaCakes118.dll windows:4 windows x86 arch:x86
0f7466572a33efb6aa4eba6074fec424
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
DestroyWindow
DestroyIcon
DestroyCursor
CreateMenu
CreateIconFromResourceEx
CreateIconFromResource
CreateIcon
CreateDesktopW
CreateCursor
CreateAcceleratorTableA
CopyRect
CharUpperA
CharToOemBuffA
CharPrevA
CharLowerA
BeginPaint
kernel32
FreeResource
lstrlenA
lstrcpyA
WriteFile
TlsGetValue
TlsFree
TlsAlloc
Sleep
SetLastError
RtlUnwind
RaiseException
OpenFileMappingA
OpenFile
LocalAlloc
LoadLibraryA
LeaveCriticalSection
GetVersionExA
EnumResourceLanguagesA
EnumResourceTypesA
ExitProcess
ExitThread
FlushFileBuffers
GetLastError
GetModuleHandleA
GetStartupInfoA
GetSystemTimeAsFileTime
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 54KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE