Static task
static1
Behavioral task
behavioral1
Sample
aed026b9825870151125a661a7d16f41_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
aed026b9825870151125a661a7d16f41_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
aed026b9825870151125a661a7d16f41_JaffaCakes118
-
Size
218KB
-
MD5
aed026b9825870151125a661a7d16f41
-
SHA1
7ddf764f5d5b87cdb00ab6ea1449e24b0c299453
-
SHA256
a4c9bd1cf835370fb07b038f9532d9becd5473b638ce606739517f082bf69d57
-
SHA512
29f4ab9c05776e2dd0f9ee5c369285f18cb4d6de36dce98173533746f6a1b0e5a4762e062dd1dacc6fa44716c4d016455235ecb1b016a111f8005e29cf155db5
-
SSDEEP
6144:SMezVAh8BH2ug25kENQlePYOrYaI61lJZ:SMeyh8Eug2OEkelrLIUj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aed026b9825870151125a661a7d16f41_JaffaCakes118
Files
-
aed026b9825870151125a661a7d16f41_JaffaCakes118.dll windows:5 windows x86 arch:x86
50f3ba4d19bd37d6af362845acbbe195
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
VirtualProtect
CloseHandle
WriteProcessMemory
CreateThread
lstrlenA
CreateFileA
WriteFile
WaitForMultipleObjects
lstrcpynA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
GetTickCount
GetProcAddress
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateEventA
SetEvent
WaitForSingleObject
lstrcpyA
FreeLibrary
GetComputerNameA
GetProcessHeap
SetEndOfFile
WriteConsoleW
SetStdHandle
FlushFileBuffers
GetLastError
Sleep
GetCurrentProcess
WinExec
LoadLibraryA
CreateDirectoryA
GetFileAttributesA
GetWindowsDirectoryA
InitializeCriticalSection
lstrcatA
GetConsoleMode
GetConsoleCP
HeapReAlloc
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapSize
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
SetFilePointer
ReadFile
IsValidCodePage
GetOEMCP
VirtualAlloc
VirtualFree
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
EncodePointer
DecodePointer
MultiByteToWideChar
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
GetModuleHandleW
ExitProcess
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
LCMapStringW
GetCPInfo
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
IsProcessorFeaturePresent
GetStdHandle
GetModuleFileNameW
HeapCreate
HeapDestroy
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
LoadLibraryW
GetLocaleInfoW
GetACP
CreateFileW
user32
wsprintfA
FindWindowA
ws2_32
WSAStartup
advapi32
RegEnumValueA
RegOpenKeyExA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
OpenProcessToken
RegCloseKey
wininet
HttpQueryInfoA
HttpAddRequestHeadersA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetReadFile
InternetCloseHandle
shlwapi
PathFileExistsA
StrStrIA
psapi
GetModuleBaseNameA
EnumProcessModules
EnumProcesses
Sections
.text Size: 169KB - Virtual size: 169KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ