blackhole
Static task
static1
Behavioral task
behavioral1
Sample
014e3aab3fc00afac432136d810d3787_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
014e3aab3fc00afac432136d810d3787_JaffaCakes118
-
Size
328KB
-
MD5
014e3aab3fc00afac432136d810d3787
-
SHA1
3858f65530c1121c7a577df3b2d82bb2c5ba34eb
-
SHA256
d35cfd317a949cbe6ef7adefa086fb05638057fc7f569ee8e5d6ad18bab233af
-
SHA512
f23b3e420099a2d2d27d02df74059d974d3604718b4fe0deaf93ebf283545dbf03319bcfb719771fe7265007094add85668b79ab178a237652e50287ae8c4c32
-
SSDEEP
6144:rkBmpyuTidq7BJm4numz90vmOIBtZOsBnWt3z:EmpNTk+BY4nZ/Oh3z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 014e3aab3fc00afac432136d810d3787_JaffaCakes118
Files
-
014e3aab3fc00afac432136d810d3787_JaffaCakes118.dll windows:4 windows x86 arch:x86
301b7738cc6a479c69784be7b91fdd19
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
MultiByteToWideChar
GetFileSize
GetCurrentProcess
LocalFree
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetVersionExA
RaiseException
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TerminateProcess
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
SetUnhandledExceptionFilter
VirtualAlloc
HeapReAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
CloseHandle
SetFilePointer
GetCPInfo
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
IsBadReadPtr
IsBadCodePtr
InitializeCriticalSection
InterlockedExchange
VirtualQuery
GetSystemInfo
SetStdHandle
HeapSize
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
VirtualProtect
LoadLibraryA
GetModuleHandleA
GetProcAddress
FlushFileBuffers
CopyFileA
GetLastError
FreeLibrary
SetFileAttributesA
user32
GetSystemMetrics
advapi32
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
IsValidSid
OpenProcessToken
Exports
Exports
Sections
.text Size: 136KB - Virtual size: 134KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.init_t Size: 4KB - Virtual size: 329B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.init_d Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 888B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE