CleanFile
Static task
static1
Behavioral task
behavioral1
Sample
81d1d994894e74455aa07b2c00c4ee93_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
81d1d994894e74455aa07b2c00c4ee93_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
81d1d994894e74455aa07b2c00c4ee93_JaffaCakes118
-
Size
364KB
-
MD5
81d1d994894e74455aa07b2c00c4ee93
-
SHA1
9c0b032c52348691c4d2fcf338456f83890cd2f6
-
SHA256
f43e586bca54aca7fcc68c43edcbb1386a44db47e49a8011b5a13804517a2f89
-
SHA512
1915b2b64ef872971e488cf20f4f76248890a40638e2d2f85f44eaf92fe9f11af5d33d79b07e2fa73bd31db5a83987b44247a309fae5f362c5ba53348a0b6bb1
-
SSDEEP
6144:flNqsTDPyZZ7C4n0lbYyrN7ea0ijfcPU0ehcdie:R0Z7C4n0lbYuN7ea04fcPWhcEe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 81d1d994894e74455aa07b2c00c4ee93_JaffaCakes118
Files
-
81d1d994894e74455aa07b2c00c4ee93_JaffaCakes118.dll windows:4 windows x86 arch:x86
dd111966530a288a3c8a8a5f9c784c3c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
RemoveDirectoryA
FindClose
FindNextFileA
FindFirstFileA
SetEndOfFile
CreateDirectoryA
CopyFileA
FreeLibrary
GetProcAddress
LoadLibraryA
CompareStringW
CompareStringA
GetLocaleInfoW
GetSystemDirectoryA
GetTickCount
GetModuleFileNameA
WideCharToMultiByte
GetFileSize
CreateFileA
CreateFileMappingA
MapViewOfFile
FlushViewOfFile
IsBadReadPtr
UnmapViewOfFile
SetFilePointer
ReadFile
WriteFile
MoveFileA
SetFileAttributesA
DeleteFileA
MoveFileExA
GetFileAttributesA
GetCurrentProcess
LocalFree
CloseHandle
GetLastError
GetProcessHeap
HeapAlloc
GetLocalTime
HeapFree
GetTimeZoneInformation
SetEnvironmentVariableA
SetConsoleCtrlHandler
GetOEMCP
GetACP
GetVersionExA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
RtlUnwind
GetFileType
HeapReAlloc
GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetStdHandle
SetHandleCount
GetStdHandle
GetStartupInfoA
DeleteCriticalSection
ExitProcess
TerminateProcess
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
VirtualAlloc
IsBadWritePtr
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
InterlockedDecrement
InterlockedIncrement
Sleep
GetModuleHandleA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
FlushFileBuffers
MultiByteToWideChar
SetUnhandledExceptionFilter
IsBadCodePtr
UnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetCPInfo
user32
wsprintfA
MessageBoxA
advapi32
RegCloseKey
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
AddAce
GetAce
EqualSid
AddAccessAllowedAce
AllocateAndInitializeSid
SetEntriesInAclA
SetNamedSecurityInfoA
OpenProcessToken
FreeSid
LookupPrivilegeValueA
AdjustTokenPrivileges
GetUserNameA
LookupAccountNameA
GetFileSecurityA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
InitializeAcl
DeleteAce
SetSecurityDescriptorDacl
SetFileSecurityA
RegCreateKeyA
shell32
SHGetSpecialFolderPathA
shlwapi
PathFileExistsA
PathFindExtensionA
StrStrIA
PathIsDirectoryA
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Exports
Exports
Sections
.text Size: 316KB - Virtual size: 312KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ