DoOpenPipeStream
Static task
static1
Behavioral task
behavioral1
Sample
a6d08a322b32721ca11aaa208f7a5b62_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a6d08a322b32721ca11aaa208f7a5b62_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
a6d08a322b32721ca11aaa208f7a5b62_JaffaCakes118
-
Size
244KB
-
MD5
a6d08a322b32721ca11aaa208f7a5b62
-
SHA1
b4e21da94dbaee21b162157523df1e7c19166364
-
SHA256
89c5c87405f2f39c0b6e3bd0cb941177653f41c0515148a3ac6ee93505704b21
-
SHA512
604537e3e8334f83a3fcb329cc19590a3ba10a7b0471d31f292223d72044de5e2a3341bddac2b24327521f998ed678e362db696308f5da0e2d3a4329f0bd292c
-
SSDEEP
3072:Yl6GG8nqyssGXe2GsFf3XcLEimaP26yw99z64ocliyxgXZW/f8Y:I6G5nqy5irPV6vO6r9PtIEE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a6d08a322b32721ca11aaa208f7a5b62_JaffaCakes118
Files
-
a6d08a322b32721ca11aaa208f7a5b62_JaffaCakes118.dll windows:5 windows x86 arch:x86
bd15b5f1449dcc013b735676585f988a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualFree
GetProcAddress
LoadLibraryW
GetModuleHandleW
GetCurrentThreadId
GetModuleFileNameW
GetCurrentProcessId
MoveFileExW
DeleteFileW
GetACP
FreeLibrary
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetErrorMode
ExpandEnvironmentStringsW
GetLastError
Sleep
SetCurrentDirectoryA
GetComputerNameW
CreateThread
GetProcessHeap
SetEndOfFile
CreateFileA
CreateFileW
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetModuleHandleA
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RaiseException
RtlUnwind
GetCPInfo
GetStringTypeW
LCMapStringA
LCMapStringW
HeapAlloc
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapCreate
HeapDestroy
VirtualAlloc
HeapReAlloc
CloseHandle
WriteFile
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FlushFileBuffers
ReadFile
SetFilePointer
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
HeapSize
GetStringTypeA
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
advapi32
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetUserNameW
shell32
SHGetFolderPathW
SHCreateDirectoryExW
ws2_32
send
getaddrinfo
socket
connect
recv
setsockopt
shutdown
closesocket
WSAStartup
__WSAFDIsSet
select
freeaddrinfo
Exports
Exports
Sections
.text Size: 195KB - Virtual size: 194KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ