SetBListA
Static task
static1
Behavioral task
behavioral1
Sample
eb29b5ddec5d4ed3cee084c5ba1102bf_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eb29b5ddec5d4ed3cee084c5ba1102bf_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
eb29b5ddec5d4ed3cee084c5ba1102bf_JaffaCakes118
-
Size
48KB
-
MD5
eb29b5ddec5d4ed3cee084c5ba1102bf
-
SHA1
2141f58327e5eb6a2204d383a5ebe742519a475b
-
SHA256
aec2a72aa14446e004c82355708aa31334352124c9721aabed4ccfd1bf964f13
-
SHA512
5d1e6f01209cf1eab7b6e960f5f9ab1b6035c68e1cf9c840e31cbfe037c63733d831a80184fad6c1cfe9dae6ca94b525908da5183dde91ef8f31f4e83cf32bc1
-
SSDEEP
768:ByWqnveCuI/fwanPGypnXwccaTMftTxYdygC7ejo9lP:JqnvtvnPGKFoR68d7So7P
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb29b5ddec5d4ed3cee084c5ba1102bf_JaffaCakes118
Files
-
eb29b5ddec5d4ed3cee084c5ba1102bf_JaffaCakes118.dll windows:4 windows x86 arch:x86
6adcefdea06e7d12c806d918e6a44d97
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
TlsAlloc
GetTickCount
SetFilePointer
FileTimeToLocalFileTime
GetVersion
QueryPerformanceCounter
GetCurrentThreadId
VirtualAlloc
GetSystemTimeAsFileTime
IsValidCodePage
GetDriveTypeA
CloseHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
GetCurrentProcessId
lstrcmpiA
LCMapStringA
GetOEMCP
GetACP
GetProcAddress
MultiByteToWideChar
GetCPInfo
RtlUnwind
GetCommandLineA
ExitProcess
TerminateProcess
GetCurrentProcess
HeapDestroy
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
HeapAlloc
HeapReAlloc
user32
GetForegroundWindow
GetClientRect
gdi32
Rectangle
shlwapi
PathFileExistsA
StrStrIA
advapi32
RegOpenKeyExA
RegSetValueExW
ole32
CoTaskMemAlloc
CoInitialize
Exports
Exports
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ