Behavioral task
behavioral1
Sample
43e70d6cf34bc35a8eb6ea8dfba21b79_JaffaCakes118.dll
Resource
win7-20241010-en
General
-
Target
43e70d6cf34bc35a8eb6ea8dfba21b79_JaffaCakes118
-
Size
92KB
-
MD5
43e70d6cf34bc35a8eb6ea8dfba21b79
-
SHA1
69b9b263dba9980b9727fd81c0aae9ae9aaa0e24
-
SHA256
b56f9325b6ab85e7e629ad5ebaeef8ede6c65649d3d86ac629a700f8206d9928
-
SHA512
7fcd4a78402adfe12420f98acd10efa6de856d7dc4f9b696cf0182a227fe9c4010be0e55429b5cf5ed3c081e5559e04edcc281004db85bcd8ad646e9d23eace0
-
SSDEEP
1536:3lmQ5z121fW36JBjWH8lOQnAPP3Lpqs+3kDUyyfI7eTy6GpRYpV800CK6:1mQ5w1RfZ8jpqs+3pcMy6QYpB056
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 43e70d6cf34bc35a8eb6ea8dfba21b79_JaffaCakes118
Files
-
43e70d6cf34bc35a8eb6ea8dfba21b79_JaffaCakes118.dll windows:4 windows x86 arch:x86
05c7df6d575c13faf78878f9450f3b20
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
GetProcAddress
ExitProcess
Sections
UPX0 Size: - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX4 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX5 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX6 Size: 80KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX7 Size: 1023B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE