Static task
static1
Behavioral task
behavioral1
Sample
2d66d35cba24cc17a7015548fd63c235_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2d66d35cba24cc17a7015548fd63c235_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
2d66d35cba24cc17a7015548fd63c235_JaffaCakes118
-
Size
53KB
-
MD5
2d66d35cba24cc17a7015548fd63c235
-
SHA1
1dfd427b0eb0efebdf83db6322c5d853b362a885
-
SHA256
63d267305a4f8d81887d295b516016d041d0f90e26f46c20c7670c8626026415
-
SHA512
eb0cd702aab62d40474aa93bc20713a4d295a036b673081edd05fadc5087823b5c3f8962e67cec4965e6905c01baf39d9d2dac2e7d6660dd00961f5aa49542bc
-
SSDEEP
1536:Zxp91MCPt0J2AAPnb1wYGprmbOCsANHatCPf:ZxZMpJuhwnclsANqCf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d66d35cba24cc17a7015548fd63c235_JaffaCakes118
Files
-
2d66d35cba24cc17a7015548fd63c235_JaffaCakes118.dll windows:4 windows x86 arch:x86
473680e3196b2171788321d42c7e20ff
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
LsaGetSystemAccessAccount
LsaCreateAccount
IsWellKnownSid
IsTextUnicode
EnumDependentServicesA
ConvertStringSidToSidA
kernel32
SetErrorMode
WriteConsoleA
TlsSetValue
TerminateProcess
SetPriorityClass
SetLastError
RtlUnwind
CloseHandle
DeleteCriticalSection
DisableThreadLibraryCalls
ExitProcess
ExitThread
ExpandEnvironmentStringsA
GetCommandLineA
GetCurrentThread
GetModuleHandleA
GetStartupInfoA
GetSystemInfo
GetVersionExA
GlobalAlloc
HeapAlloc
HeapCreate
HeapReAlloc
InterlockedDecrement
LocalAlloc
MultiByteToWideChar
security
RevertSecurityContext
AddSecurityPackageW
olepro32
OleCreatePropertyFrame
oleacc
GetRoleTextW
GetOleaccVersionInfo
CreateStdAccessibleObject
AccessibleObjectFromWindow
WindowFromAccessibleObject
setupapi
SetupDiGetDriverInfoDetailA
SetupOpenInfFileW
SetupQuerySpaceRequiredOnDriveA
SetupRemoveFromDiskSpaceListW
user32
RegisterClassExA
SetWindowPlacement
EnumChildWindows
Sections
.text Size: 40KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ