MemcpyToArrayAsync
Static task
static1
Behavioral task
behavioral1
Sample
3881106a1a3f81e730b362f6ac9bf017_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3881106a1a3f81e730b362f6ac9bf017_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
3881106a1a3f81e730b362f6ac9bf017_JaffaCakes118
-
Size
188KB
-
MD5
3881106a1a3f81e730b362f6ac9bf017
-
SHA1
50cb2c8d42ae4c543cf3f0cba6dba281d0e3cc65
-
SHA256
dcc7e498adeeb5321184e31fd181aecf661afa8dcc57c972bab4f90109a25e13
-
SHA512
94b8212458ca8fa751a188b9d184d51ee9afb5956dca4a64da060966a739d9fb6e0d0ae8cc71171c4fa28fb5d2b153cc51e18975876e632c7011538174f5fb80
-
SSDEEP
3072:Xs3VXCbCvKlJFX7F0YIMFjgaJyU/0RF0nzki52ap2LN1O7kvmm4XklCoqgGYWwLN:83dCbCEJFWGFjgaJyMgF0nzh2X3AksX8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3881106a1a3f81e730b362f6ac9bf017_JaffaCakes118
Files
-
3881106a1a3f81e730b362f6ac9bf017_JaffaCakes118.dll windows:4 windows x86 arch:x86
990d84b96ea846274c016a09eafdb992
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CreateConsoleScreenBuffer
DisableThreadLibraryCalls
ExitProcess
FileTimeToSystemTime
FormatMessageA
GetACP
GetCommandLineA
GetDateFormatA
GetLocaleInfoW
GetModuleHandleA
GetNumberFormatA
GetOEMCP
GetStartupInfoA
GetStdHandle
GetVersion
HeapAlloc
HeapCreate
HeapReAlloc
IsValidLocale
MulDiv
MultiByteToWideChar
OpenProcess
RtlUnwind
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
TlsFree
TlsSetValue
user32
SetDlgItemTextA
GetSysColor
GetCursorPos
CreateWindowExA
ole32
CoTaskMemFree
CoFileTimeNow
CoCreateInstance
advapi32
LookupPrivilegeValueW
RegUnLoadKeyA
RegSetKeySecurity
QueryServiceLockStatusA
ObjectPrivilegeAuditAlarmW
NotifyBootConfigStatus
GetEffectiveRightsFromAclW
ConvertSecurityDescriptorToStringSecurityDescriptorW
opengl32
glRectd
glTexCoord4dv
wglSwapLayerBuffers
glEvalCoord2f
Exports
Exports
Sections
.text Size: 123KB - Virtual size: 216KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ