DLL�ӿ�2
Static task
static1
Behavioral task
behavioral1
Sample
0aef15ed1eb36e0a4193f3e84708a81f_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0aef15ed1eb36e0a4193f3e84708a81f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0aef15ed1eb36e0a4193f3e84708a81f_JaffaCakes118
-
Size
179KB
-
MD5
0aef15ed1eb36e0a4193f3e84708a81f
-
SHA1
d5ccb24fbfad340b5a15614ead711f2c8d0f3649
-
SHA256
ad6b095068c372c0bc5872d9641d176349ee25533885671d3b9330f96a3cbfdb
-
SHA512
b3334d6caa8399940a5d29d007a1280a605a5b67eb32b5b1e5d8018d9814d219458d0c3b1023323364188581727fec41a9d36c79ee558720d4141d788257b8bb
-
SSDEEP
3072:CAfLG6AyY2S5ND0VvijvfoflQ+hg6ALsdxWv80BVk4OxCxY:CAfLGgbSr0VmfW3w32
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0aef15ed1eb36e0a4193f3e84708a81f_JaffaCakes118
Files
-
0aef15ed1eb36e0a4193f3e84708a81f_JaffaCakes118.dll windows:4 windows x86 arch:x86
d1b1d470695815e5d2859c5f33b4954e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrlenA
FindFirstFileA
FindClose
FindNextFileA
FreeLibrary
HeapFree
ExitProcess
HeapReAlloc
HeapAlloc
Sleep
lstrcpyA
GetProcessHeap
GetProcAddress
LoadLibraryA
GetLastError
lstrcatA
GetModuleHandleA
lstrcmpA
GetModuleFileNameA
GetCommandLineA
user32
wsprintfA
MessageBoxA
Exports
Exports
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 600B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 738B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.data Size: 169KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ