Static task
static1
Behavioral task
behavioral1
Sample
e9660db1051715fcd17eee55e4875cbd_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
e9660db1051715fcd17eee55e4875cbd_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
e9660db1051715fcd17eee55e4875cbd_JaffaCakes118
-
Size
1.2MB
-
MD5
e9660db1051715fcd17eee55e4875cbd
-
SHA1
751dfce8b159f0b80acf0843cd048f2a0a17a151
-
SHA256
ada0a86cc6b5aa4fc5a95bf2a307d98b448459cb6162af8975c51307b2db5739
-
SHA512
0a7ac665e0c74708c7a93b69a87cd2c35420fde94fff896843136c6bfeb9d376d840f2883290b5ca4141c5d63fd4917fe86bad9f9b2372f12649203b4bc9ae83
-
SSDEEP
24576:SPbZzh0E5AYbNThU9UHwOHNVNeJhcTMt2wCuKKa1caaVrczip:QRhP5L9ZmkTMtJdJrc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e9660db1051715fcd17eee55e4875cbd_JaffaCakes118
Files
-
e9660db1051715fcd17eee55e4875cbd_JaffaCakes118.dll windows:6 windows x64 arch:x64
b4a9ba650e6994628538c32c967c6bc5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
IsDBCSLeadByteEx
GetCPInfo
GetACP
IsValidCodePage
WideCharToMultiByte
HeapSize
GetTimeZoneInformation
WriteConsoleW
SetEndOfFile
DeleteFileW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
FindFirstFileExA
SetFilePointerEx
FlushFileBuffers
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
GetStdHandle
GetStringTypeW
LCMapStringW
CompareStringW
HeapReAlloc
HeapFree
MultiByteToWideChar
LoadLibraryW
CreateFileMappingA
LocalFree
LocalAlloc
LoadLibraryExW
GetProcAddress
CreateFileW
GetModuleHandleA
GetModuleFileNameW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetTickCount
CreateThread
Sleep
CreateMutexA
WaitForSingleObject
ReleaseMutex
GetLastError
CloseHandle
ReadFile
GetFullPathNameA
GetFileSize
FindNextFileA
FindFirstFileA
FindClose
HeapAlloc
GetConsoleCP
WriteFile
ReadConsoleW
GetConsoleMode
GetModuleFileNameA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCurrentProcess
TerminateProcess
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFileType
PeekNamedPipe
RtlUnwind
advapi32
GetInheritanceSourceW
SaferSetLevelInformation
SaferGetLevelInformation
SaferCloseLevel
SaferCreateLevel
LsaEnumerateAccountRights
LsaOpenPolicy
LsaClose
LsaFreeMemory
QueryServiceObjectSecurity
OpenServiceA
OpenSCManagerW
OpenSCManagerA
GetServiceDisplayNameW
CloseServiceHandle
AbortSystemShutdownA
GetCurrentHwProfileW
GetCurrentHwProfileA
OpenEventLogW
NotifyChangeEventLog
CloseEventLog
SetSecurityDescriptorControl
SetFileSecurityW
RevertToSelf
ObjectCloseAuditAlarmW
InitializeSid
InitializeAcl
ImpersonateAnonymousToken
FreeInheritedFromArray
GetSecurityDescriptorControl
SetSecurityInfo
GetSecurityInfo
GetExplicitEntriesFromAclW
AccessCheckAndAuditAlarmW
CreateWellKnownSid
GetFileSecurityW
ConvertSidToStringSidW
shlwapi
AssocCreate
StrCmpIW
StrCatBuffA
StrRetToBufA
ord29
ord156
PathCompactPathExA
PathFileExistsW
PathUnExpandEnvStringsA
ord1
SHRegOpenUSKeyA
SHRegQueryUSValueA
SHRegEnumUSValueA
SHRegCloseUSKey
ord280
SHRegGetBoolUSValueW
SHCreateStreamOnFileEx
StrRChrIA
dbghelp
SymFindFileInPath
FindExecutableImage
SymGetSymNext64
ImageDirectoryEntryToDataEx
ImagehlpApiVersion
GetTimestampForLoadedLibrary
SymSetOptions
SymFromName
SymCleanup
SymFunctionTableAccess64
SymGetLineNext64
SymGetFileLineOffsets64
SymInitialize
SymGetSearchPath
SymRegisterFunctionEntryCallback64
SymGetOptions
ImageNtHeader
imm32
ImmInstallIMEA
ImmInstallIMEW
ImmIsIME
ImmCreateContext
ImmDestroyContext
ImmGetCompositionStringA
ImmGetCompositionStringW
ImmGetCandidateListCountW
ImmGetCandidateListA
ImmGetCandidateListW
ImmGetConversionStatus
ImmSetConversionStatus
ImmGetCompositionFontW
ImmSetCompositionFontW
ImmEscapeW
ImmGetConversionListW
ImmNotifyIME
ImmGetStatusWindowPos
ImmSetStatusWindowPos
ImmGetCompositionWindow
ImmGetCandidateWindow
ImmRegisterWordW
ImmUnregisterWordW
ImmGetRegisterWordStyleA
ImmEnumRegisterWordA
ImmGetImeMenuItemsW
ImmSetCompositionStringW
rpcrt4
MesEncodeDynBufferHandleCreate
MesEncodeFixedBufferHandleCreate
MesHandleFree
MesDecodeIncrementalHandleCreate
MesEncodeIncrementalHandleCreate
I_RpcMapWin32Status
MesIncrementalHandleReset
MesDecodeBufferHandleCreate
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 165KB - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ