Static task
static1
Behavioral task
behavioral1
Sample
eaf90f2d0771399894024851452e9f3b_JaffaCakes118.dll
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
eaf90f2d0771399894024851452e9f3b_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
eaf90f2d0771399894024851452e9f3b_JaffaCakes118
-
Size
683KB
-
MD5
eaf90f2d0771399894024851452e9f3b
-
SHA1
3a4720767d1f515eab5a7b39284415a09b8edf4f
-
SHA256
156df9ee141538cfda488188fb7d4a7d2021356b0d2700c369720b8208b67e80
-
SHA512
76202a41f1c4dbfd644d38888a9c48fd2bebbb8d1d7c9056d0fbbfb01888df016f3bca908b53b33aee42cbdf57cd4c9a36390d9bd32f57361a04cb02ce5a467d
-
SSDEEP
12288:OLyA4uTdhEDhom/P4QUf6kTN/oDxpC+2rMw1iC3SkqKyM+v01:+4+dhGo1SkTNkx4vIw7SkM81
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eaf90f2d0771399894024851452e9f3b_JaffaCakes118
Files
-
eaf90f2d0771399894024851452e9f3b_JaffaCakes118.dll windows:6 windows x86 arch:x86
503675ed4e0eeb5c3949bdcfdd2a8fd0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleW
WriteFile
GetWindowsDirectoryW
DeleteFileW
DisableThreadLibraryCalls
VirtualProtect
GetLastError
GetTickCount64
CreateThread
GetCurrentProcessId
CloseHandle
GetModuleHandleA
DeviceIoControl
GetProcAddress
MultiByteToWideChar
CreateFileW
Sleep
WriteConsoleW
SetStdHandle
GetStringTypeW
LCMapStringW
HeapSize
HeapReAlloc
RtlUnwind
SetFilePointerEx
GetProcessHeap
GetTickCount
GetConsoleMode
GetConsoleCP
OutputDebugStringW
GetCPInfo
GetOEMCP
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
WideCharToMultiByte
GetStdHandle
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetFileType
DeleteCriticalSection
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
IsValidCodePage
GetACP
FlushFileBuffers
advapi32
QueryServiceStatusEx
OpenSCManagerW
OpenServiceW
StartServiceW
ChangeServiceConfigW
CreateServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
SHGetFolderPathA
fwpuclnt
FwpmCalloutDestroyEnumHandle0
FwpmFilterCreateEnumHandle0
FwpmFilterEnum0
FwpmEngineOpen0
FwpmFilterDestroyEnumHandle0
FwpmEngineClose0
FwpmFreeMemory0
FwpmFilterDeleteById0
FwpmCalloutEnum0
FwpmCalloutCreateEnumHandle0
crypt32
CertOpenStore
CertAddEncodedCertificateToStore
ws2_32
gethostbyname
WSACleanup
WSAStartup
gethostname
iphlpapi
GetAdaptersInfo
Sections
.text Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 600KB - Virtual size: 608KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ