WLSStartEvent
Static task
static1
Behavioral task
behavioral1
Sample
02cfa3d29bc83833bb0bc964900fc63c_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
02cfa3d29bc83833bb0bc964900fc63c_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
02cfa3d29bc83833bb0bc964900fc63c_JaffaCakes118
-
Size
11KB
-
MD5
02cfa3d29bc83833bb0bc964900fc63c
-
SHA1
194b9e4c9fbb3b240002e7314bf3b176afbd1c0e
-
SHA256
5b80b4d9793e81622bf3c6b00680a57f5acf75fa1652fcd6dbeb4f5c54e32b44
-
SHA512
54a0cec7a8615abd5c9984fdc2d9451cf974ccb91e4fa1b24ccd253e0f078eb4dc6cf6f681d295905bcbc34b30709b5981ab1a26c26302d05d7eed5f96274f98
-
SSDEEP
192:QXnkN27c3sgbI50qo74RKKBxC0mDWf8+kLM2Wl5v:8nkr3JA874RKKBxC0mDWf8+kLM2Wl5v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 02cfa3d29bc83833bb0bc964900fc63c_JaffaCakes118
Files
-
02cfa3d29bc83833bb0bc964900fc63c_JaffaCakes118.dll windows:4 windows x86 arch:x86
9f75376cad64a3d4b975cccbd94e66bf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
lstrlenA
OpenProcess
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
CopyFileA
GetWindowsDirectoryA
lstrcatA
GetSystemDirectoryA
WriteFile
CreateFileA
CreateRemoteThread
GetTickCount
ReadFile
MoveFileExA
lstrcpyA
SetFileAttributesA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetModuleFileNameA
Sleep
SetErrorMode
CreateThread
CreateEventA
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleA
FindFirstFileA
FindClose
OpenEventA
GetLastError
CloseHandle
DeleteFileA
GetLocalTime
user32
wsprintfA
advapi32
RegDeleteKeyA
RegCreateKeyA
RegQueryValueExA
RegCloseKey
RegEnumKeyA
RegSetValueExA
wininet
InternetOpenA
InternetOpenUrlA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetGetConnectedState
msvcrt
free
_adjust_fdiv
malloc
_initterm
Exports
Exports
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1004B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 538B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ