WSPStartup
Static task
static1
Behavioral task
behavioral1
Sample
f032bde126b9e69c454cc43a2a4aafc1_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f032bde126b9e69c454cc43a2a4aafc1_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f032bde126b9e69c454cc43a2a4aafc1_JaffaCakes118
-
Size
17KB
-
MD5
f032bde126b9e69c454cc43a2a4aafc1
-
SHA1
b54fc92b7c7ebf72de0d28dd8362be56c5c11e3d
-
SHA256
ca3b3d7fb0101cb7d68d23097549b0df2aea2fe7b5fae7dfc224751298cfedda
-
SHA512
4e2b203568b4cf890f6d723ff0452f2d0f2421495bf796b0fa88a2ffa204cb1c96db9a21052e40240e4d338ecffdfe009513729e95ca588ed09a06212a7bae3b
-
SSDEEP
384:TqKsF3PS9uiVOrFmVUSczDzML7dbALTicsOYMWio2:TcPdiQrFmVgzHmbAL+rsD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f032bde126b9e69c454cc43a2a4aafc1_JaffaCakes118
Files
-
f032bde126b9e69c454cc43a2a4aafc1_JaffaCakes118.dll windows:4 windows x86 arch:x86
34c2fad6efc789aae5f37d8099976af3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
OpenMutexA
WaitForSingleObject
GetCurrentThreadId
EnterCriticalSection
TerminateThread
LoadLibraryA
GetVersionExA
CreateMutexA
HeapAlloc
GetCurrentProcess
GetProcessHeap
GetProcAddress
GetComputerNameA
GlobalMemoryStatus
lstrcmpiA
GetDiskFreeSpaceExA
RemoveDirectoryA
SetLastError
LeaveCriticalSection
CreateDirectoryA
GetSystemDirectoryA
WinExec
CloseHandle
FindFirstFileA
FileTimeToLocalFileTime
GlobalFree
HeapFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetDriveTypeA
DeleteFileA
FileTimeToSystemTime
Sleep
FindNextFileA
GetLastError
FindClose
GetLogicalDrives
user32
GetDC
ReleaseDC
gdi32
CreateCompatibleDC
GetObjectA
DeleteObject
BitBlt
GetStockObject
SelectPalette
DeleteDC
GetDIBits
SelectObject
RealizePalette
GetDeviceCaps
CreateDCA
CreateCompatibleBitmap
advapi32
SetSecurityDescriptorOwner
OpenProcessToken
GetTokenInformation
InitializeSecurityDescriptor
RegCloseKey
SetSecurityDescriptorDacl
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
shell32
SHGetFileInfoA
msvcrt
fwrite
fopen
fseek
sprintf
fclose
_beginthreadex
ftell
fread
ws2_32
htons
inet_addr
WSASocketA
WSAGetLastError
shutdown
closesocket
WSAGetOverlappedResult
WSAResetEvent
WSAWaitForMultipleEvents
recv
WSASend
WSARecv
WSACloseEvent
WSACreateEvent
ioctlsocket
inet_ntoa
gethostbyname
gethostname
socket
connect
Exports
Exports
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ