Behavioral task
behavioral1
Sample
e196cb8634a911d280eb5fcde5ba9ba3_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e196cb8634a911d280eb5fcde5ba9ba3_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
e196cb8634a911d280eb5fcde5ba9ba3_JaffaCakes118
-
Size
660KB
-
MD5
e196cb8634a911d280eb5fcde5ba9ba3
-
SHA1
1f08a20c86a22660474e773c7148f48d4b03fa4f
-
SHA256
da3d821af1f9ac29a6fc5e4133bde82788c42c9098ce21a7d6d1cbc762930a79
-
SHA512
a063b46f6b125d9a1f4ff6ea9416755c10b094b45e241af820b5f2e56be9d4ae02164381a2aa5ae0dd8c9939856ef6a28f258ef59d8473592ebb664c064d36de
-
SSDEEP
3072:jvg696HM0XnpvTyQvGn+nCuhTr8npE3dvvq9aGNLlcIOMEvbzQu7d:LgK4TyQOI5JgpcvqNplcIqzku7d
Malware Config
Signatures
-
resource yara_rule sample aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e196cb8634a911d280eb5fcde5ba9ba3_JaffaCakes118
Files
-
e196cb8634a911d280eb5fcde5ba9ba3_JaffaCakes118.dll windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 135KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE