Static task
static1
Behavioral task
behavioral1
Sample
e021b6428dfdb3d0bd3adcc58a414db3_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
e021b6428dfdb3d0bd3adcc58a414db3_JaffaCakes118
-
Size
165KB
-
MD5
e021b6428dfdb3d0bd3adcc58a414db3
-
SHA1
01c33b1946e773de957f7b915e8a88be1a8d9b65
-
SHA256
6dafc44bca20aefb9e3903af264255e2451813ebbed79de53205a0bc2e0928c3
-
SHA512
365e3a8c61804d400cb979fb442b394e1feb6ce5c67de056a0482e25f7d2e164e80879fe3735b8ea321bb2374d98ccf299b719cb07894f59db83abd94ef20375
-
SSDEEP
3072:8+nZ7iDVn9/ugoC+zfgzSOP/GVgnJxvpWeYeQj2g0J+S+8gu/doQtz0:8+nZMnJu9PDgzwktpWevQKg0JN+8g6d0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e021b6428dfdb3d0bd3adcc58a414db3_JaffaCakes118
Files
-
e021b6428dfdb3d0bd3adcc58a414db3_JaffaCakes118.dll windows:4 windows x86 arch:x86
1c9fd87e3738a28d8ab6f48b3c011152
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
IsDBCSLeadByte
LoadLibraryA
InterlockedDecrement
GetModuleFileNameA
GetProcAddress
GetStartupInfoA
Sleep
MulDiv
GetSystemTimeAsFileTime
VirtualAlloc
VirtualProtect
QueryPerformanceFrequency
IsDebuggerPresent
SetLastError
GetLastError
GetCurrentProcess
IsBadStringPtrA
GetProcessHeap
IsBadReadPtr
GetUserDefaultLCID
user32
GetCursor
GetWindowRect
GetClientRect
GetWindowTextLengthA
GetWindowTextA
IsCharUpperA
GetWindowDC
GetDC
WindowFromDC
GetIconInfo
GetAncestor
GetWindowInfo
GetWindowThreadProcessId
IsWindowVisible
GetParent
BlockInput
SetLastErrorEx
IsChild
IsWindowUnicode
advapi32
IsValidAcl
GetUserNameA
msvcrt
_adjust_fdiv
malloc
_initterm
free
_memicmp
_CIcosh
memchr
srand
_CIfmod
_set_error_mode
_CIacos
localeconv
_pctype
_isctype
__mb_cur_max
modf
_errno
_CIsinh
gdi32
GetBitmapDimensionEx
GetBkColor
GetStretchBltMode
GdiGetBatchLimit
GetPixel
ole32
CoGetCurrentProcess
shell32
ord524
ord66
ord680
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ