GetThumbnailFromExifTiff
Static task
static1
Behavioral task
behavioral1
Sample
0ecab279a365ad258fed7d1345653ed9_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0ecab279a365ad258fed7d1345653ed9_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0ecab279a365ad258fed7d1345653ed9_JaffaCakes118
-
Size
220KB
-
MD5
0ecab279a365ad258fed7d1345653ed9
-
SHA1
4fece00a2ee53f91ec298f62dec6a6b69c04a566
-
SHA256
01505c5a0ff50d8eb20ce37002f3211cc5336e69f235ee515987536e8cb5364b
-
SHA512
44581f3cbfa924b6128b3f75dd9dd78dfbd51f0d5ab09fba484c9169bf0d856039562c7cc1a620d1be782cc9d2dadf8e1921f7b36d06aa5dda5c9db90e89c699
-
SSDEEP
6144:AkbAjjoEYCema2LOq0UX/cV4pA30qDj21npV:AWA/fasB0UPMLbDaV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ecab279a365ad258fed7d1345653ed9_JaffaCakes118
Files
-
0ecab279a365ad258fed7d1345653ed9_JaffaCakes118.dll windows:4 windows x86 arch:x86
c1ade5d159bf9c6140c09290d1404c19
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CompareStringA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FatalAppExitA
FileTimeToLocalFileTime
FindFirstFileA
GetCommandLineA
GetCurrentDirectoryA
GetExitCodeThread
GetFileTime
GetModuleHandleA
GetProcessAffinityMask
GetVersionExA
HeapAlloc
HeapCreate
HeapReAlloc
HeapSize
InterlockedIncrement
LoadLibraryA
MulDiv
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
RtlUnwind
SearchPathA
SetErrorMode
SetLastError
SetUnhandledExceptionFilter
TlsAlloc
TlsSetValue
WideCharToMultiByte
WriteFile
lstrcmpA
lstrcpyA
lstrcpynA
lstrlenW
user32
SetForegroundWindow
ScreenToClient
ReleaseDC
PeekMessageA
InvalidateRgn
GetWindow
GetMenu
GetKeyState
ExitWindowsEx
DeleteMenu
DefDlgProcA
CreateWindowExA
ClientToScreen
BeginPaint
advapi32
CreateServiceW
ElfBackupEventLogFileA
InitiateSystemShutdownA
LsaRemovePrivilegesFromAccount
RegQueryInfoKeyA
CryptReleaseContext
ddraw
DDInternalLock
DDInternalUnlock
ole32
CoSetCancelObject
IsEqualGUID
CoGetInstanceFromFile
CoCreateInstance
Exports
Exports
Sections
.text Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 92KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ