Behavioral task
behavioral1
Sample
045bbc52153351a4209becd6a3fb4b19_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
045bbc52153351a4209becd6a3fb4b19_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
045bbc52153351a4209becd6a3fb4b19_JaffaCakes118
-
Size
595KB
-
MD5
045bbc52153351a4209becd6a3fb4b19
-
SHA1
413786b6140381defa6757484079f9fbfb1cec19
-
SHA256
d4fc25b38f5f38b32d4759b9f9851084355d992929f4671dd5c84064226ca53a
-
SHA512
05b54d2c95a761ceb11ce2aa44974b09ab14607d62d1e711b2b7ff7fd7a48d8686253432d327c8a4ecbd325c144ccb3afc60729490a8dc8b89827602e5bdfe1f
-
SSDEEP
6144:kNO0D4PSmVHgp6cp09IKj2A5XBrw8PSaUCS3V8QRpxAOGoiD:QO0EzVAveP3U8PKCS3aQB0oi
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 045bbc52153351a4209becd6a3fb4b19_JaffaCakes118
Files
-
045bbc52153351a4209becd6a3fb4b19_JaffaCakes118.dll windows:4 windows x86 arch:x86
b4f8d3a9936a8087d274e585d291a450
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LeaveCriticalSection
IsBadWritePtr
WriteProcessMemory
GetCurrentProcess
VirtualProtect
GetProcAddress
Sleep
GetModuleHandleA
CreateThread
ExitProcess
WritePrivateProfileStringA
GetPrivateProfileIntA
GetModuleFileNameA
IsBadReadPtr
VirtualQuery
HeapAlloc
GetProcessHeap
SetUnhandledExceptionFilter
InterlockedExchange
InitializeCriticalSection
GetOEMCP
GetACP
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
ReadFile
SetEndOfFile
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetSystemInfo
VirtualAlloc
LoadLibraryA
SetFilePointer
CreateFileA
FlushFileBuffers
SetStdHandle
WideCharToMultiByte
MultiByteToWideChar
TerminateProcess
RtlUnwind
GetSystemTimeAsFileTime
GetLocalTime
GetCurrentThreadId
GetCommandLineA
GetVersionExA
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
DeleteCriticalSection
LCMapStringW
EnterCriticalSection
CloseHandle
GetTimeZoneInformation
RaiseException
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
GetCPInfo
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
LCMapStringA
IsBadCodePtr
tier0
Msg
g_VProfCurrentProfile
?GetSubNode@CVProfNode@@QAEPAV1@PBDH0H@Z
?EnterScope@CVProfNode@@QAEXXZ
?ExitScope@CVProfNode@@QAE_NXZ
Error
g_pMemAlloc
GetCPUInformation
user32
FindWindowA
GetWindowTextA
wsprintfA
GetAsyncKeyState
vstdlib
RandomSeed
RandomFloat
Q_strncpy
Q_snprintf
KeyValuesSystem
Q_strnicmp
winmm
timeGetTime
Sections
UPX0 Size: 592KB - Virtual size: 592KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE