DoeServices
Behavioral task
behavioral1
Sample
fbe5f1b13a5fe32335bdf8f982f8e4e8_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fbe5f1b13a5fe32335bdf8f982f8e4e8_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fbe5f1b13a5fe32335bdf8f982f8e4e8_JaffaCakes118
-
Size
640KB
-
MD5
fbe5f1b13a5fe32335bdf8f982f8e4e8
-
SHA1
92bd9e2629850644aa4ad6be96bfa7483c9d2559
-
SHA256
2d62bd9e13360903655b147ba9dec13ef667a4e39485a0ea88b208dee74a07fe
-
SHA512
4dfc9e3e8d532e3d4d4527875f8ff3c3118ca3318818daa85aa310e28855b620a60981fef5391fb372bce66e59c1734df51fba6afd901bda968099226ae1f8ec
-
SSDEEP
12288:F+Zh4/hEgpycDYWuewC5M4QheoAiDcMPNikpHuZBxqmasSE:F+bmz/k+2dNwSwGGB8mJ
Malware Config
Signatures
-
resource yara_rule sample aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fbe5f1b13a5fe32335bdf8f982f8e4e8_JaffaCakes118
Files
-
fbe5f1b13a5fe32335bdf8f982f8e4e8_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
CODE Size: 509KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 10KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 43KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 66KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE