WinMapTray
Static task
static1
Behavioral task
behavioral1
Sample
01652b43e5808d0d550b609f2bef2fcc_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
01652b43e5808d0d550b609f2bef2fcc_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
01652b43e5808d0d550b609f2bef2fcc_JaffaCakes118
-
Size
152KB
-
MD5
01652b43e5808d0d550b609f2bef2fcc
-
SHA1
9ae90d83e93035e684d5cb592f7076e35f799494
-
SHA256
5c9b32cdc74d3f7b8b863d2ed866c281431d659ffa1723899baee937685edbd9
-
SHA512
2d0221ed89e3c0ed7dcba698e0a3ab8fea64119a40687442723fe8b2d43973ca6b3553b688f0e50a68611b170b732702d8e687b72978e98808a850ecba3fa934
-
SSDEEP
3072:Q/hmi4RSMP01XayNED47FzatRdqXRoXzRgtv8O1kIt/L:QciVM81Xam2wzaYXuqkoD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 01652b43e5808d0d550b609f2bef2fcc_JaffaCakes118
Files
-
01652b43e5808d0d550b609f2bef2fcc_JaffaCakes118.dll windows:4 windows x86 arch:x86
9da7813e6ab45f840a5d6857fceeb3e1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcess
ExitProcess
GetCommandLineA
CopyFileA
LoadLibraryA
GetModuleHandleA
CreateDirectoryA
HeapAlloc
CreateFileA
TerminateProcess
Sleep
EnterCriticalSection
SetLastError
GetProcessHeap
MapViewOfFile
GetComputerNameA
GetVolumeInformationA
OpenFileMappingA
GlobalFree
LeaveCriticalSection
ReadProcessMemory
GetTickCount
WaitForSingleObject
InterlockedCompareExchange
WriteFile
GlobalAlloc
InterlockedIncrement
CreateProcessA
CloseHandle
GetModuleFileNameA
OpenEventA
CreateEventA
CreateMutexW
LocalFree
GetLastError
GetProcAddress
WriteProcessMemory
CreateFileMappingA
InterlockedDecrement
UnmapViewOfFile
HeapFree
ole32
CoTaskMemAlloc
CoInitialize
CoCreateGuid
CoSetProxyBlanket
OleCreate
OleSetContainedObject
CoCreateInstance
CoUninitialize
user32
GetMessageA
UnhookWindowsHookEx
GetCursorPos
CreateWindowExA
SetWindowsHookExA
GetClassNameA
KillTimer
GetParent
GetWindow
RegisterWindowMessageA
PostQuitMessage
PeekMessageA
DestroyWindow
ScreenToClient
DispatchMessageA
DefWindowProcA
SetTimer
GetWindowLongA
GetSystemMetrics
FindWindowA
TranslateMessage
SetWindowLongA
ClientToScreen
SendMessageA
GetWindowThreadProcessId
oleaut32
SysFreeString
SysStringLen
SysAllocString
SysAllocStringLen
shlwapi
StrStrIW
UrlUnescapeW
advapi32
RegDeleteKeyA
GetUserNameA
RegQueryValueExA
DuplicateTokenEx
SetTokenInformation
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
OpenProcessToken
RegCloseKey
shell32
SHGetFolderPathA
Exports
Exports
Sections
.text Size: 120KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pkibl Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ