Run
Static task
static1
Behavioral task
behavioral1
Sample
92001e9cebec0f0f0ac2b7c7e04f017d_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
92001e9cebec0f0f0ac2b7c7e04f017d_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
92001e9cebec0f0f0ac2b7c7e04f017d_JaffaCakes118
-
Size
216KB
-
MD5
92001e9cebec0f0f0ac2b7c7e04f017d
-
SHA1
a9eb9a1734bb84bbc60df38d4a1e02a870962857
-
SHA256
98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a
-
SHA512
a03469f5109e059f4b7682fd2caef016ed168816023ac3306048e9924cd5575a20b21adf6f4fcea3582ba19dcb9fbe6bb6f7f99045a11ef4b7f5efb7c5270fb2
-
SSDEEP
6144:MlO3aEsyxOS3Y+lWGKUaTQVNWyculdI4:MlOUyxOSXzaVy5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 92001e9cebec0f0f0ac2b7c7e04f017d_JaffaCakes118
Files
-
92001e9cebec0f0f0ac2b7c7e04f017d_JaffaCakes118.dll windows:4 windows x86 arch:x86
9adf0d7419a9ef36a0214c1edee97438
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WideCharToMultiByte
MultiByteToWideChar
DeleteFileW
SetFileAttributesW
CreateFileW
GetLastError
DeleteFileA
SetFileAttributesA
GetTickCount
GetLocalTime
Sleep
FileTimeToSystemTime
SystemTimeToFileTime
GetProcAddress
GetModuleHandleA
WaitForSingleObject
CreateProcessA
GetLogicalDriveStringsA
LoadLibraryA
FindNextFileA
FindFirstFileA
GetTempPathA
HeapFree
HeapAlloc
GetProcessHeap
InterlockedDecrement
GlobalFree
GlobalAlloc
CreateThread
CreateMutexA
OpenMutexA
CopyFileA
FindClose
FindNextFileW
FindFirstFileW
TerminateThread
lstrcmpiA
SetStdHandle
FlushFileBuffers
IsBadWritePtr
VirtualAlloc
VirtualFree
GetModuleFileNameA
SetFilePointer
WriteFile
CreateFileA
GetFileSize
ReadFile
GetTempFileNameA
CloseHandle
LocalFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
HeapCreate
HeapDestroy
GetStartupInfoA
GetStdHandle
SetHandleCount
SetUnhandledExceptionFilter
HeapSize
HeapReAlloc
IsBadCodePtr
IsBadReadPtr
LCMapStringW
LCMapStringA
GetCurrentProcess
GetStringTypeW
GetStringTypeA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetOEMCP
GetACP
GetCPInfo
TerminateProcess
TlsGetValue
SetLastError
RtlUnwind
GetTimeZoneInformation
GetSystemTime
RaiseException
GetFileType
GetFileAttributesA
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
InterlockedIncrement
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetEndOfFile
user32
wsprintfA
advapi32
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
shell32
StrCmpNIA
StrStrIA
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
oleaut32
VariantClear
shlwapi
PathFindFileNameW
PathAppendA
PathFileExistsW
PathFindFileNameA
PathAppendW
PathFileExistsA
wininet
HttpAddRequestHeadersA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetOpenA
InternetConnectA
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
InternetQueryDataAvailable
InternetReadFile
InternetCloseHandle
mpr
WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum
Exports
Exports
Sections
.text Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ