Static task
static1
Behavioral task
behavioral1
Sample
0855d0b2e4f9615c24c6ecff21084ccd_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0855d0b2e4f9615c24c6ecff21084ccd_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
0855d0b2e4f9615c24c6ecff21084ccd_JaffaCakes118
-
Size
376KB
-
MD5
0855d0b2e4f9615c24c6ecff21084ccd
-
SHA1
053aeb5728e76de4a4f6c48b1ec8fda756d3d42b
-
SHA256
95bc8848b2753372b074644eafad2d52626eba36afa6c5c2580ece42ad2dbd2e
-
SHA512
05e721ac5b6f0c510e467e1b0fc540797fd9ece71c89a729156c02bc470f945a3eb447eef1289753ccdd45321b69f0c26327e01772a61516fd94ccbb54cb81df
-
SSDEEP
6144:C7Yrj4hxGJ+6Ru6zLvmiiV8oLydVpPrVnLUeeqFc4S:CS42J+WZLvXzd/rhnZ64S
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0855d0b2e4f9615c24c6ecff21084ccd_JaffaCakes118
Files
-
0855d0b2e4f9615c24c6ecff21084ccd_JaffaCakes118.dll windows:4 windows x86 arch:x86
7fb1feb1eef9d7fd542bc3d203e5222c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
OpenFileMappingA
lstrlenA
MapViewOfFile
UnmapViewOfFile
lstrcpynA
MapViewOfFileEx
GetTickCount
VirtualFree
InitializeCriticalSection
LeaveCriticalSection
ReadFile
lstrcmpiA
GetProcAddress
VirtualAlloc
EnterCriticalSection
SearchPathA
LoadLibraryA
CreateFileMappingA
LocalAlloc
GetModuleFileNameA
GetModuleHandleA
GetTempFileNameA
GetTempPathA
GetComputerNameA
LoadLibraryExW
CopyFileA
LoadLibraryW
SetFileAttributesA
VirtualAllocEx
DisableThreadLibraryCalls
MultiByteToWideChar
WriteProcessMemory
CreateRemoteThread
WaitForSingleObject
Sleep
CloseHandle
CreateFileW
WriteFile
GetModuleHandleW
GetTempPathW
GetTempFileNameW
GetCurrentProcessId
DeleteFileW
OutputDebugStringA
FlushInstructionCache
CreateProcessW
IsBadReadPtr
GetCurrentThread
CreateProcessA
GetCurrentProcess
ResumeThread
GetLastError
VirtualQuery
InterlockedCompareExchange
GetCurrentThreadId
SuspendThread
GetThreadContext
SetThreadContext
TlsGetValue
TlsSetValue
SetLastError
GetFileSize
DeleteCriticalSection
CreateFileA
OpenMutexA
VirtualProtect
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsFree
LCMapStringA
WideCharToMultiByte
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
RtlUnwind
user32
SetWindowsHookExA
CallNextHookEx
PostMessageA
wsprintfA
UnhookWindowsHookEx
advapi32
GetUserNameA
Sections
.text Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data0 Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data1 Size: 284KB - Virtual size: 281KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ