Static task
static1
Behavioral task
behavioral1
Sample
097e4899d8927b78111070208be3c4a9_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
097e4899d8927b78111070208be3c4a9_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
097e4899d8927b78111070208be3c4a9_JaffaCakes118
-
Size
150KB
-
MD5
097e4899d8927b78111070208be3c4a9
-
SHA1
a3181dbb1f63157faaa7269f4fde94e2070026fa
-
SHA256
9d9d7698df0b48cf9e573b47cc33f2dc2b5c674ae68cb4f6fd38c4885d412808
-
SHA512
b155223719338fad3690134b66c84a0ae6852efcb3e39cb43d7da331b9f6214c58e16ed501991ac76120c1a913bfbbe8a7a76eac67cd79761e104998764d033b
-
SSDEEP
3072:LMM1502pZIGYcWBjbaYyKvo3EW3bNasxnoAs4vQxG4OFw9JERyZp+0uAwoYxMm:4M1tpZIXXpoU4a2jbYbOF2Z7uAc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 097e4899d8927b78111070208be3c4a9_JaffaCakes118
Files
-
097e4899d8927b78111070208be3c4a9_JaffaCakes118.dll windows:4 windows x86 arch:x86
ce28ff9b576e4fdd7ebfe7413c33bfe0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExpandEnvironmentStringsW
lstrcatW
SetFileAttributesW
lstrcmpiW
CopyFileW
lstrcpynW
GetProcessHeap
RegisterWaitForSingleObject
InterlockedDecrement
SetEvent
ResetEvent
CreateEventW
SetFilePointer
GetTempFileNameW
GetVolumeNameForVolumeMountPointW
WriteFile
FlushFileBuffers
ReadFile
ReleaseMutex
CreateFileW
CreateMutexW
RemoveDirectoryW
MoveFileW
GetVolumeInformationW
GetSystemDirectoryW
LoadLibraryExW
FormatMessageW
DeleteFileW
LocalAlloc
LocalFree
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
GetOEMCP
GetStringTypeW
GetACP
GetDriveTypeW
GetDiskFreeSpaceExW
GetSystemTimeAsFileTime
QueueUserWorkItem
FreeLibrary
LoadLibraryW
lstrcpyW
lstrlenW
GetCurrentThreadId
GetFileAttributesW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FindFirstFileW
lstrcmpW
HeapDestroy
QueryDosDeviceW
CreateDirectoryW
FindNextFileW
FindClose
lstrlenA
lstrcatA
lstrcpyA
CreateProcessA
CreateDirectoryA
GetSystemDirectoryA
GetSystemInfo
WaitForSingleObject
CloseHandle
GetVolumeInformationA
GetCommandLineA
OpenMutexW
VirtualProtect
GetCPInfo
HeapReAlloc
RtlUnwind
GetVersion
ExitProcess
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapAlloc
VirtualAlloc
user32
GetSystemMetrics
LoadBitmapA
GetKeyboardType
LoadStringW
CharUpperW
wsprintfW
GetSysColor
MessageBoxA
advapi32
RegisterEventSourceW
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyW
RegDeleteValueW
RegSetValueExW
CloseServiceHandle
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
LsaClose
LsaQueryInformationPolicy
SetSecurityInfo
SetEntriesInAclW
AllocateAndInitializeSid
EqualSid
GetAce
GetAclInformation
RegCreateKeyExW
SetThreadToken
RegDeleteKeyW
RegUnLoadKeyW
RegEnumValueW
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegQueryInfoKeyA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
DeregisterEventSource
ole32
CoUninitialize
CoTaskMemFree
Sections
.text Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ