EntryPoint
Static task
static1
Behavioral task
behavioral1
Sample
1495ee8765655b66533effc91af08a72_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
1495ee8765655b66533effc91af08a72_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
1495ee8765655b66533effc91af08a72_JaffaCakes118
-
Size
27KB
-
MD5
1495ee8765655b66533effc91af08a72
-
SHA1
7dc5af4ace0a4f6004c7598ae906349fe0941fbe
-
SHA256
ebdc901593211943d114fc9558726dacb80ac9455635a2f85dcd93adea7a0e95
-
SHA512
1e3d5096225260e7034deaee561b7cfc07c64e36d630f6661dbd749421d2440f74e722d55d421b8a3ef5617e46ebceb98639986b0dab7f31adf0cdaf6a576e62
-
SSDEEP
384:H17ddjQ2cS21OPIz5neeMLkpQGzdgtad858DjrUqm8/dWKyWJrtNDhmVBEz:HpddjQ2cS5sQe3QGzdguxQrstr/hmIz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1495ee8765655b66533effc91af08a72_JaffaCakes118
Files
-
1495ee8765655b66533effc91af08a72_JaffaCakes118.dll windows:4 windows x86 arch:x86
d6e6eedfdfec18291597d8c7dbbd113d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
advapi32
OpenProcessToken
psapi
GetModuleFileNameExA
ws2_32
WSAStartup
wininet
HttpOpenRequestA
Exports
Exports
Sections
.text Size: 21KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE