Static task
static1
Behavioral task
behavioral1
Sample
0c5dd64a29eb688968e6f5a1999c2f41_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0c5dd64a29eb688968e6f5a1999c2f41_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0c5dd64a29eb688968e6f5a1999c2f41_JaffaCakes118
-
Size
26KB
-
MD5
0c5dd64a29eb688968e6f5a1999c2f41
-
SHA1
a5ed67777aabf038bdaaddb09cc27c033d39928e
-
SHA256
96adb3c83471f6a2faabe0afb3098ec659580c86a057198ada6af3811fc0ade8
-
SHA512
c5a365e2acd95e9f934be7341eb7e386ffce4fd6887da4533bfe4081cd207a1ac888555019700e4d8bff27a71af0b2ee65e9e55d61ce9389d36a14feeb3c6f2f
-
SSDEEP
768:zM8vJfI5hPfY/6tex66m1qkZmfkIQ2SjIgSO:zMUAxPDt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c5dd64a29eb688968e6f5a1999c2f41_JaffaCakes118
Files
-
0c5dd64a29eb688968e6f5a1999c2f41_JaffaCakes118.dll windows:5 windows x86 arch:x86
74df1b3c6c54c36398ca87cabe71a1d1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
ZwOpenFile
ZwQueryValueKey
LdrFindResource_U
LdrAccessResource
swprintf
ZwProtectVirtualMemory
strcmp
RtlImageDirectoryEntryToData
_stricmp
LdrGetDllHandle
memset
ZwDelayExecution
ZwAlertThread
ZwDuplicateObject
RtlComputeCrc32
RtlStringFromGUID
ZwTestAlert
RtlEqualUnicodeString
RtlEqualString
LdrGetProcedureAddress
sprintf
memcmp
memcpy
ZwOpenEvent
LdrFindEntryForAddress
ZwSetInformationKey
ZwWaitForSingleObject
ZwSetTimer
ZwCreateTimer
ZwCreateKey
RtlInitUnicodeString
wcschr
ZwClose
ZwQueryKey
ZwOpenKey
RtlNtStatusToDosError
wcscpy
_allshr
_aullrem
kernel32
HeapFree
DisableThreadLibraryCalls
GetModuleHandleW
CreateThread
BindIoCompletionCallback
GetLastError
GetTickCount
SetThreadLocale
GetProcessHeap
HeapAlloc
FreeLibraryAndExitThread
DeactivateActCtx
ActivateActCtx
Sleep
GetSystemTimeAsFileTime
CreateProcessW
ExpandEnvironmentStringsW
user32
DefWindowProcW
GetParent
EndPaint
UnhookWindowsHookEx
SetWindowsHookExW
DialogBoxParamW
RegisterClassW
LoadCursorW
GetWindowLongW
BeginPaint
CallNextHookEx
UnregisterClassW
FillRect
OpenDesktopW
SetThreadDesktop
CloseDesktop
SendMessageW
PostMessageW
GetWindowRect
CreateWindowExW
SetWindowPos
GetClientRect
SetWindowLongW
GetDlgCtrlID
SetLayeredWindowAttributes
SetDlgItemTextW
LoadStringW
SetDlgItemInt
GetDlgItem
SetTimer
GetDlgItemInt
EndDialog
MessageBoxW
DestroyWindow
PostQuitMessage
ws2_32
WSAStartup
WSASend
WSARecv
WSAIoctl
bind
closesocket
WSAGetLastError
WSASocketW
WSACleanup
rpcrt4
UuidCreateSequential
gdi32
SetBkColor
CreateSolidBrush
GetStockObject
CreateFontIndirectW
DeleteObject
SelectObject
TextOutW
MoveToEx
CreatePen
LineTo
SetTextColor
secur32
DecryptMessage
QueryContextAttributesW
FreeContextBuffer
EncryptMessage
DeleteSecurityContext
AcquireCredentialsHandleW
FreeCredentialsHandle
InitializeSecurityContextW
msvcrt
_except_handler3
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 344B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
shr Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ