Static task
static1
Behavioral task
behavioral1
Sample
fa2816bbb43a8b2687152163f2271b5b_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fa2816bbb43a8b2687152163f2271b5b_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
fa2816bbb43a8b2687152163f2271b5b_JaffaCakes118
-
Size
96KB
-
MD5
fa2816bbb43a8b2687152163f2271b5b
-
SHA1
3068751fcfc978eb47173cfe323af4695b135d71
-
SHA256
0febab81f589e7945a6b47f67ef6f370e403e0b76944884992677ee338cfffad
-
SHA512
4bb344cc38af9a2d093f92acfda6cfb110f363cd9c9a7ea029f589fe13be2fd52a679cfe6afd582cd69ca926854250474b9ae76be5d9980ce53ff6efb3bbd268
-
SSDEEP
1536:HB8LGFJWzyTUQ1wTki+zeJTSMa2Z4b3Gqtf1hn/Zw:HWgDSyg/Z4aqtf1hn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa2816bbb43a8b2687152163f2271b5b_JaffaCakes118
Files
-
fa2816bbb43a8b2687152163f2271b5b_JaffaCakes118.dll windows:4 windows x86 arch:x86
1117138d162d70ca49b1c6b061f4e984
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
LoadLibraryW
GetProcAddress
GetModuleHandleA
lstrcpynA
GetLastError
GetSystemDefaultLangID
CloseHandle
TerminateProcess
Sleep
GlobalFree
GlobalAlloc
GetVersionExA
GlobalMemoryStatus
WideCharToMultiByte
MultiByteToWideChar
ExpandEnvironmentStringsA
DeleteFileA
DisableThreadLibraryCalls
CreateThread
lstrcpyA
MoveFileExA
GetCurrentProcess
ExitProcess
CompareStringW
CompareStringA
SetEndOfFile
GetStringTypeW
HeapFree
HeapAlloc
GetTimeZoneInformation
GetSystemTime
GetLocalTime
RtlUnwind
GetCommandLineA
GetVersion
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
WriteFile
ReadFile
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
InterlockedDecrement
InterlockedIncrement
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
CreateFileA
GetStringTypeA
SetEnvironmentVariableA
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
shell32
DoEnvironmentSubstA
shlwapi
PathFileExistsA
iphlpapi
GetAdaptersInfo
ws2_32
inet_ntoa
inet_addr
Sections
.text Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ