Static task
static1
Behavioral task
behavioral1
Sample
f026b869085204f8d1e91ff1b096ff0f_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f026b869085204f8d1e91ff1b096ff0f_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f026b869085204f8d1e91ff1b096ff0f_JaffaCakes118
-
Size
68KB
-
MD5
f026b869085204f8d1e91ff1b096ff0f
-
SHA1
df8f58b8d4cd136cb20e47ea6248722544550f96
-
SHA256
2f30a2bebba2a280b72b1670365f8ebadcd57668c133a38c8e47a0e08bec2090
-
SHA512
dc7f0ecca4b13d6ed3421ecf2e8a427c729a621c361cca95f17bd79639640893f70fdc7921bf3fb2c23b87344b134858a241049b4f939c31a4da817dbab4bb13
-
SSDEEP
1536:PKG17N1btLUbLTA1S2cWW58786NHEpc6kqzSAJ:PKG17N1bUTA812HEaqzSAJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f026b869085204f8d1e91ff1b096ff0f_JaffaCakes118
Files
-
f026b869085204f8d1e91ff1b096ff0f_JaffaCakes118.dll windows:4 windows x86 arch:x86
d76425e973e5a8c6b06ecc5d2e85c138
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleFileNameA
CreateFileA
GetLastError
FormatMessageA
LocalFree
GetFileSize
CloseHandle
GetProcessHeap
HeapAlloc
HeapFree
TerminateProcess
GetFileTime
GetSystemTimeAsFileTime
MoveFileA
SetFileAttributesA
GetShortPathNameA
CompareStringA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetLastError
FreeLibrary
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersionExA
lstrlenA
DisableThreadLibraryCalls
GlobalFree
GetCommandLineA
VirtualProtect
GetTempPathA
GlobalAlloc
user32
MessageBoxA
LoadStringA
advapi32
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
gdi32
GetObjectA
GetDeviceCaps
GetObjectType
GetCurrentObject
rpcrt4
NdrDllRegisterProxy
msvcr71
_vsnprintf
__dllonexit
__CppXcptFilter
_adjust_fdiv
_except_handler3
free
_XcptFilter
_onexit
_initterm
malloc
Sections
.text Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ