Static task
static1
Behavioral task
behavioral1
Sample
1688213bc5f70643deab5bdb02c0ae6c_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
1688213bc5f70643deab5bdb02c0ae6c_JaffaCakes118
-
Size
570KB
-
MD5
1688213bc5f70643deab5bdb02c0ae6c
-
SHA1
b126be6cbc4543a57474a97bf8d4c439de56b4c2
-
SHA256
3aa6735651a8c21a6beff73d8c0a8ed8e7f5e62165a9f44e85cdedd063464252
-
SHA512
46798f5350024a6b8ca8303bc6c1cdd97ae13056ea722dd41bf72aaed9bdd627c024669ee4ba5bdc91efb0840965c86b929835f1acb64094705137c1a1cb9c6f
-
SSDEEP
6144:pXhlbaTbLY6VhaQOJz3utQd24SQ5J5HvoNQ/JyRpYrC:pXh5a7BV83utQd24JvorRpY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1688213bc5f70643deab5bdb02c0ae6c_JaffaCakes118
Files
-
1688213bc5f70643deab5bdb02c0ae6c_JaffaCakes118.dll windows:4 windows x86 arch:x86
ec6a208ea44aa0cfbe495182d0a438c3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
VirtualAlloc
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
GetProcessHeap
GetConsoleMode
GetConsoleCP
LCMapStringW
SizeofResource
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSize
ExitProcess
Sleep
HeapReAlloc
HeapFree
HeapAlloc
RaiseException
RtlUnwind
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GlobalFlags
WritePrivateProfileStringW
GlobalAddAtomW
GlobalFindAtomW
LoadLibraryA
GetVersionExA
GetModuleHandleA
InterlockedIncrement
InterlockedDecrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
GetCurrentProcessId
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
LoadLibraryW
InterlockedExchange
lstrcmpW
SetErrorMode
GetProcAddress
GetModuleFileNameW
lstrlenA
lstrcmpA
WideCharToMultiByte
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
lstrlenW
SetLastError
GetCommandLineW
GetModuleHandleW
GetVersionExW
CreateFileW
FindFirstFileW
FindNextFileW
FindClose
LoadLibraryExW
FormatMessageW
FreeLibrary
GetFileAttributesW
GetCurrentProcess
CloseHandle
GetLastError
LocalAlloc
LocalFree
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
LCMapStringA
VirtualAllocEx
user32
LoadIconA
GetOpenClipboardWindow
GetLastActivePopup
gdi32
GetStockObject
PathToRegion
StrokePath
Sections
.text Size: 436KB - Virtual size: 435KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data2 Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data4 Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data3 Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 90KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ