Static task
static1
Behavioral task
behavioral1
Sample
070ef22e5204f93f7e801867e1fbda65_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
070ef22e5204f93f7e801867e1fbda65_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
070ef22e5204f93f7e801867e1fbda65_JaffaCakes118
-
Size
228KB
-
MD5
070ef22e5204f93f7e801867e1fbda65
-
SHA1
95596fe989fa09e6272fc3ca3ec6e0c0c14e722b
-
SHA256
fb48f5f5ef182334f414c99d23aad86745b691ff5afda665dbff028ba280be05
-
SHA512
a35c56bf1d9b27279c20cc4c3a70789ad718eeaba9262aaf1bc115e479c06682cbbd7c23038dffa255d1cbc29b72dc4344485d3d1213f671a1040ceb6d042466
-
SSDEEP
3072:1QBRzdhoFHpLoAp5USplYz+P7A+VsHI6ESK92hljrvCddQnY5R8eInsNyjUhA1UY:1QBRzuoK8+Pt5F4hhY8eMYywhLZm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 070ef22e5204f93f7e801867e1fbda65_JaffaCakes118
Files
-
070ef22e5204f93f7e801867e1fbda65_JaffaCakes118.dll windows:4 windows x86 arch:x86
7a1b4cd744d5ab6a011133115ee2e2cc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LocalAlloc
GetSystemTimeAsFileTime
GetLocaleInfoW
IsDebuggerPresent
OutputDebugStringA
FormatMessageA
FormatMessageW
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
ReleaseMutex
GetFileSize
DeviceIoControl
GetFileInformationByHandle
CreateEventW
CreateFileW
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTime
SetEvent
LoadLibraryW
GetProcAddress
LocalLock
LocalReAlloc
LocalUnlock
DefineDosDeviceW
LeaveCriticalSection
GetCurrentThread
CloseHandle
Sleep
FreeLibrary
ExpandEnvironmentStringsW
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetModuleHandleA
CreateEventA
GetTimeFormatA
GetDateFormatA
GetLocalTime
GetTickCount
LoadLibraryA
UnregisterWait
GetProfileIntW
InterlockedExchange
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
RaiseException
lstrcmpiA
GetProcessHeap
HeapAlloc
GetModuleFileNameW
LocalFree
EnterCriticalSection
SetLastError
DeleteCriticalSection
InitializeCriticalSection
lstrlenW
lstrcmpiW
CopyFileW
SetFileAttributesW
FindNextFileW
GetFileAttributesExW
FindClose
FindFirstFileW
lstrcatW
lstrcpyW
GetLastError
InterlockedCompareExchange
WaitForSingleObject
CreateThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualProtect
GlobalFree
GetCommandLineA
QueryDosDeviceW
GlobalAlloc
user32
SendInput
GetScrollInfo
GetActiveWindow
ShowWindow
EndPaint
DestroyMenu
CopyRect
GetWindowRect
SendMessageW
DestroyAcceleratorTable
FillRect
GetDlgItem
IsWindow
DestroyWindow
CharNextW
PostMessageW
GetFocus
SetFocus
DefWindowProcW
BeginPaint
GetClientRect
IsChild
advapi32
RegCloseKey
ImpersonateLoggedOnUser
TraceMessage
MakeSelfRelativeSD
OpenEncryptedFileRawW
EncryptFileW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetFileSecurityW
CloseEncryptedFileRaw
ReadEncryptedFileRaw
RegDisablePredefinedCache
SetServiceStatus
SetThreadToken
RevertToSelf
OpenThreadToken
GetUserNameW
DeregisterEventSource
RegSetValueExW
RegQueryInfoKeyW
gdi32
CreateSolidBrush
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC
ole32
CoInitializeEx
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
rpcrt4
RpcRevertToSelf
RpcServerUnregisterIf
RpcImpersonateClient
NdrClientCall2
RpcSmDestroyClientContext
RpcBindingFree
msvcr71
wcspbrk
_wtoi
_snwprintf
rand
srand
strncpy
_ultow
memset
memcpy
realloc
_errno
_callnewh
_onexit
free
towupper
_vsnwprintf
malloc
_initterm
_adjust_fdiv
__CppXcptFilter
__dllonexit
wcscat
_wcsupr
iswctype
wcschr
wcscspn
_wcsicmp
time
wcscmp
wcsstr
wcstok
wcscpy
wcsncpy
sprintf
_except_handler3
printf
wcslen
Sections
.text Size: 196KB - Virtual size: 195KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ