kiu
Static task
static1
Behavioral task
behavioral1
Sample
f9cfe4c344c5316285a93c61b9c838f7_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f9cfe4c344c5316285a93c61b9c838f7_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f9cfe4c344c5316285a93c61b9c838f7_JaffaCakes118
-
Size
72KB
-
MD5
f9cfe4c344c5316285a93c61b9c838f7
-
SHA1
69c6b6d91ac324fd73a4560ad96f0d9492dbf290
-
SHA256
116d2f164af1776894c580d49b56c3894cc0c96e1ed73a6edd77a7673478e136
-
SHA512
44af8fb8080b529c8590ee28f6e4f68cd69d120c701acb1f4d1cd225d69e062a7311c10c15ad47d6d89c0e10344f6a3ee9cf2a7a7f04b0ecd207a83515f567b5
-
SSDEEP
1536:T0dDKjLGY3l459jIPaCTMK4aG4kn2KcOy0PGa90j4Mia6b68TI5U+j:T0dWNa59jIPaOMKFGx80744q6m8cdj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f9cfe4c344c5316285a93c61b9c838f7_JaffaCakes118
Files
-
f9cfe4c344c5316285a93c61b9c838f7_JaffaCakes118.dll windows:4 windows x86 arch:x86
b48ce23572f7e82a1d8f23e3e9fe04fd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
user32
GetKeyboardType
DestroyWindow
MessageBoxA
SetTimer
MessageBoxA
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetCurrentThreadId
VirtualQuery
GetStartupInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
WriteProcessMemory
VirtualProtectEx
TerminateProcess
ReadProcessMemory
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetCurrentProcess
FreeLibrary
LoadLibraryA
VirtualAlloc
GetModuleFileNameA
ExitProcess
wsock32
inet_addr
htons
Exports
Exports
Sections
.text Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 256B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 10KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: - Virtual size: 63B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ooro0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ooro1 Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ooro2 Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ooro3 Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 84B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ