Static task
static1
Behavioral task
behavioral1
Sample
b7af0a290842cb363feaf2253f9c3e45_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b7af0a290842cb363feaf2253f9c3e45_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
b7af0a290842cb363feaf2253f9c3e45_JaffaCakes118
-
Size
458KB
-
MD5
b7af0a290842cb363feaf2253f9c3e45
-
SHA1
87564e23429c8b93cc06aef3567783c65579b6e5
-
SHA256
19ce0038a6dd243eddba9aefa43687bfb91b2cec14948b56bd0b023cb06513d1
-
SHA512
2a1d3a1f576f3cf62577d65683d75bfdef3275d173bc7b2d2b46f22028047e91691e9030923a639a3e280896eddd9126a0748c4c553fddee34c62bb4ea672de9
-
SSDEEP
12288:4KRRrDQptcxuqB6xFFqQYgZdVxxTHsjc3/d:4KRdDQpWxuqwxFFqPjc3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b7af0a290842cb363feaf2253f9c3e45_JaffaCakes118
Files
-
b7af0a290842cb363feaf2253f9c3e45_JaffaCakes118.dll windows:6 windows x86 arch:x86
0e07eccfb2af9199837e641a5bebfe29
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
QueryPerformanceCounter
GlobalAlloc
GlobalLock
GlobalUnlock
DisableThreadLibraryCalls
CreateThread
VirtualProtect
FreeLibraryAndExitThread
GetModuleHandleA
Sleep
GetProcAddress
VirtualQuery
GetModuleFileNameA
GetCurrentProcess
K32GetModuleInformation
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
QueryPerformanceFrequency
GetTickCount64
MultiByteToWideChar
GetPrivateProfileStringA
ResetEvent
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CloseHandle
CreateDirectoryA
InitializeSListHead
WritePrivateProfileStringA
user32
SetCursor
GetAsyncKeyState
CallWindowProcA
GetClipboardData
GetKeyState
CloseClipboard
OpenClipboard
FindWindowA
SetWindowLongA
EmptyClipboard
GetClientRect
SetClipboardData
shell32
SHGetFolderPathA
msvcp140
?uncaught_exception@std@@YA_NXZ
?_BADOFF@std@@3_JB
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
imm32
ImmSetCompositionWindow
ImmGetContext
vcruntime140
memchr
__std_terminate
memmove
__std_type_info_destroy_list
_except_handler4_common
_CxxThrowException
memset
__vcrt_InitializeCriticalSectionEx
memcpy
__CxxFrameHandler3
__std_exception_copy
strchr
__std_exception_destroy
_purecall
strstr
api-ms-win-crt-math-l1-1-0
_except1
_libm_sse2_pow_precise
_libm_sse2_exp_precise
_libm_sse2_sqrt_precise
ceil
floor
fmaxf
_libm_sse2_cos_precise
_CIfmod
_CIatan2
_libm_sse2_sin_precise
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
terminate
_errno
_wassert
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
fread
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fwrite
__stdio_common_vsprintf_s
_get_stream_buffer_pointers
__stdio_common_vsprintf
ftell
fputc
fopen
__acrt_iob_func
__stdio_common_vsscanf
fgetc
_wfopen
fflush
fclose
__stdio_common_vfprintf
fseek
api-ms-win-crt-convert-l1-1-0
atoi
strtol
atof
api-ms-win-crt-string-l1-1-0
_stricmp
strncpy
towlower
isprint
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_stat64i32
_unlock_file
Sections
.text Size: 383KB - Virtual size: 382KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ