Static task
static1
Behavioral task
behavioral1
Sample
1ec414cd6b4c04747919188a66186447_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1ec414cd6b4c04747919188a66186447_JaffaCakes118.dll
Resource
win10v2004-20240419-en
General
-
Target
1ec414cd6b4c04747919188a66186447_JaffaCakes118
-
Size
584KB
-
MD5
1ec414cd6b4c04747919188a66186447
-
SHA1
deaa782b7317a470aff133721b88e99ed9a39df3
-
SHA256
22627ff0be3e5ab0fb589919c3bf0b8875c3e68c1aadf192d342b34aff06cbfa
-
SHA512
0952500d07c53c72779e4396879c097f2c2070ebd80828e52092914f5546802283fb4dec780d28e9ff43d6e39260e566d1b277b6d628d0c9f5a47f157b5bba05
-
SSDEEP
12288:Duh5afNTF6xSmegpZ+ENHXhUKfsf3jWL:Duq0xSmDZ+ENjsf3jWL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1ec414cd6b4c04747919188a66186447_JaffaCakes118
Files
-
1ec414cd6b4c04747919188a66186447_JaffaCakes118.dll windows:6 windows x86 arch:x86
b18d2addde2a14ee6e41cccd7ae20886
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
QueryPerformanceCounter
GlobalAlloc
GlobalLock
GlobalUnlock
DisableThreadLibraryCalls
CreateThread
GetModuleHandleA
GetProcAddress
VirtualProtect
FreeLibraryAndExitThread
Sleep
VirtualQuery
GetModuleFileNameA
GetCurrentProcess
K32GetModuleInformation
GetTickCount
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
QueryPerformanceFrequency
GetTickCount64
MultiByteToWideChar
GetPrivateProfileStringA
ResetEvent
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CloseHandle
CreateDirectoryA
WritePrivateProfileStringA
GetSystemTimeAsFileTime
user32
SetCursor
GetAsyncKeyState
CallWindowProcA
GetClipboardData
GetKeyState
CloseClipboard
OpenClipboard
FindWindowA
SetWindowLongA
EmptyClipboard
GetClientRect
SetClipboardData
shell32
SHGetFolderPathA
msvcp140
?uncaught_exception@std@@YA_NXZ
?_BADOFF@std@@3_JB
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
imm32
ImmGetContext
ImmSetCompositionWindow
vcruntime140
memchr
__std_terminate
memmove
__std_type_info_destroy_list
_except_handler4_common
_CxxThrowException
memset
__vcrt_InitializeCriticalSectionEx
memcpy
__CxxFrameHandler3
__std_exception_copy
strchr
__std_exception_destroy
_purecall
strstr
api-ms-win-crt-math-l1-1-0
_libm_sse2_pow_precise
_except1
_libm_sse2_exp_precise
_libm_sse2_cos_precise
_libm_sse2_sqrt_precise
ceil
floor
fmaxf
_CIfmod
_CIatan2
_libm_sse2_sin_precise
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
terminate
_errno
_wassert
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fwrite
__stdio_common_vsprintf_s
fgetc
_get_stream_buffer_pointers
fputc
fopen
__acrt_iob_func
fflush
__stdio_common_vsscanf
fread
_wfopen
fclose
fseek
__stdio_common_vfprintf
ftell
api-ms-win-crt-convert-l1-1-0
atoi
strtol
atof
api-ms-win-crt-string-l1-1-0
strncpy
towlower
isprint
_stricmp
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
_stat64i32
Sections
.text Size: 502KB - Virtual size: 502KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ