Static task
static1
Behavioral task
behavioral1
Sample
f0ac41a7ae3a0a05086f78cae606886d_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f0ac41a7ae3a0a05086f78cae606886d_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f0ac41a7ae3a0a05086f78cae606886d_JaffaCakes118
-
Size
72KB
-
MD5
f0ac41a7ae3a0a05086f78cae606886d
-
SHA1
ca97c772b8ad499203204c55072a3de0730565e9
-
SHA256
f1acd2a05557a2f7f65fd9b257d11ac6a7fb5811cf0cd6c7a4b97348a58cba1b
-
SHA512
5c834cd1436c590ef525d34a76dfa562c73c3f97f11141a8c2183d281c528b6864a5491d9a80c7b68465f174648bd0127d9e62b6d309a6296b2fda8060083fc1
-
SSDEEP
1536:chqUoFk5OiZ1mEVSbq+CJWPjLcJsOJICl:QKimgJWfFOWCl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f0ac41a7ae3a0a05086f78cae606886d_JaffaCakes118
Files
-
f0ac41a7ae3a0a05086f78cae606886d_JaffaCakes118.dll windows:4 windows x86 arch:x86
8f68f3ec033a8f8d4811d419622aa325
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetTimeFormatA
GetTimeZoneInformation
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LocalAlloc
LocalFree
OpenProcess
VirtualAllocEx
VirtualFreeEx
WideCharToMultiByte
WriteFile
WriteProcessMemory
lstrcatA
lstrcpyA
lstrlenA
Sleep
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
CreateThread
InitializeCriticalSection
GetWindowsDirectoryA
Process32Next
TerminateProcess
Process32First
CreateToolhelp32Snapshot
ExitThread
GetProcAddress
LoadLibraryA
GetTickCount
HeapSize
LCMapStringW
GetLocalTime
GetDateFormatA
CreateRemoteThread
CreateFileA
DeleteFileA
CloseHandle
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
SetEndOfFile
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetCPInfo
GetOEMCP
GetACP
FlushFileBuffers
SetStdHandle
InterlockedExchange
RtlUnwind
VirtualQuery
GetSystemInfo
VirtualProtect
MultiByteToWideChar
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
GetLastError
ReadFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
ExitProcess
GetCurrentProcess
GetModuleFileNameA
user32
wsprintfA
FindWindowA
GetWindowThreadProcessId
CharUpperA
advapi32
RegOpenKeyA
RegEnumKeyExA
RegCloseKey
IsTextUnicode
RegQueryValueExA
ole32
CreateStreamOnHGlobal
GetHGlobalFromStream
shlwapi
StrStrA
PathFileExistsA
StrStrIA
wsock32
socket
htons
connect
closesocket
recv
send
ioctlsocket
inet_addr
htonl
gethostbyaddr
getsockname
WSAStartup
gethostbyname
wininet
FindNextUrlCacheEntryA
InternetGetConnectedState
FindFirstUrlCacheEntryA
FindCloseUrlCache
DeleteUrlCacheEntryA
urlmon
URLDownloadToFileA
Sections
.text Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ