Static task
static1
Behavioral task
behavioral1
Sample
0eda8ac33baff0bc945982f5cbbaaca5_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0eda8ac33baff0bc945982f5cbbaaca5_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0eda8ac33baff0bc945982f5cbbaaca5_JaffaCakes118
-
Size
1.6MB
-
MD5
0eda8ac33baff0bc945982f5cbbaaca5
-
SHA1
5d489e389c7762f322a0f0af570e87945ee01b35
-
SHA256
d548d15ade5499b21a063f5abfbd516c3a44f0799fdce0181a415de46a620199
-
SHA512
f70dac1005f9e6462caeafb21fed6d736e6ddee1fb184959d08f263cb2070c5623c11c312c0a7c35f161e6902a4a8856352f9698720823b19bf3cb4dbc29984e
-
SSDEEP
49152:PCiBPPDHks/TQLGWFdIdrP2Xuuke6TBtUi:BTzYXuukeVi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0eda8ac33baff0bc945982f5cbbaaca5_JaffaCakes118
Files
-
0eda8ac33baff0bc945982f5cbbaaca5_JaffaCakes118.dll windows:4 windows x86 arch:x86
3723c5f43e3ff4e21ebd716acf94f1cb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SizeofResource
FindResourceA
SetFileAttributesA
RemoveDirectoryA
GetCurrentProcess
GetShortPathNameA
WinExec
WritePrivateProfileStringA
SetFileTime
MoveFileExA
IsBadWritePtr
GetPrivateProfileSectionNamesA
WritePrivateProfileSectionA
FlushFileBuffers
DisableThreadLibraryCalls
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
SetHandleCount
GetStringTypeW
GetStringTypeA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
VirtualFree
HeapCreate
GetEnvironmentVariableA
SetUnhandledExceptionFilter
HeapSize
HeapReAlloc
ExitProcess
TlsGetValue
TlsFree
LoadResource
GetCommandLineA
ExitThread
TlsSetValue
GetCurrentThreadId
CreateThread
HeapAlloc
HeapFree
RaiseException
RtlUnwind
GetCurrentThread
QueryPerformanceCounter
lstrcatA
lstrcpynA
ResetEvent
VirtualProtect
TerminateProcess
GetLocalTime
InterlockedExchange
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
IsBadCodePtr
SetStdHandle
LockResource
SetEvent
GetPrivateProfileSectionA
GetVersion
GetTickCount
GetWindowsDirectoryA
GetTempPathA
GetDiskFreeSpaceA
SetLastError
WaitForSingleObject
FreeLibrary
SearchPathA
LoadLibraryExA
GetSystemDirectoryA
LoadLibraryA
GetCurrentProcessId
GetFileTime
GetFileSize
CreateEventA
QueryPerformanceFrequency
DosDateTimeToFileTime
LocalFileTimeToFileTime
WriteFile
GetVersionExA
CompareStringW
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetSystemTime
SystemTimeToFileTime
CompareStringA
VirtualQuery
CreateFileMappingA
GetSystemInfo
MapViewOfFile
UnmapViewOfFile
IsBadReadPtr
SetFilePointer
ReadFile
CreateFileA
lstrcmpA
CreateProcessA
Sleep
GetModuleHandleA
GetProcAddress
CloseHandle
GetPrivateProfileIntA
GetPrivateProfileStringA
MoveFileA
DeleteFileA
CopyFileA
CreateDirectoryA
GetFileAttributesA
FindFirstFileA
lstrcmpiA
FindClose
FindNextFileA
GetUserDefaultLCID
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
LocalFree
FormatMessageA
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
lstrlenW
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
lstrcpyA
lstrlenA
MultiByteToWideChar
GetLastError
TlsAlloc
MulDiv
FreeResource
GetStdHandle
user32
WaitForInputIdle
CharUpperA
GetDesktopWindow
PostThreadMessageA
DispatchMessageA
TranslateMessage
GetMessageA
ExitWindowsEx
ScreenToClient
GetWindowRect
FillRect
GetSysColor
PeekMessageA
MsgWaitForMultipleObjects
GetDlgItem
MoveWindow
SetWindowPos
SetWindowLongA
wsprintfA
ReleaseDC
GetDC
IsWindow
SetWindowTextA
ReleaseCapture
SetCursor
LoadCursorA
SetCapture
LoadStringA
ShowWindow
SetWindowRgn
IsIconic
CopyRect
OffsetRect
DrawTextA
GetDlgCtrlID
GetDlgItemTextA
GetWindowDC
EnumChildWindows
IntersectRect
GetClassNameA
AdjustWindowRectEx
GetWindowLongA
UpdateWindow
EnableWindow
RedrawWindow
MessageBeep
BeginPaint
EndPaint
SendMessageA
CreateWindowExA
GetWindow
SystemParametersInfoA
MapWindowPoints
CreateDialogIndirectParamA
GetWindowPlacement
ClientToScreen
GetSystemMetrics
SetFocus
SetDlgItemTextA
GetParent
InvalidateRect
DialogBoxParamA
GetSystemMenu
RemoveMenu
AppendMenuA
GetClientRect
GetWindowTextLengthA
GetWindowTextA
RegisterClassExA
DefWindowProcA
LoadIconA
DestroyWindow
gdi32
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
CreateBitmap
StretchBlt
SetBkColor
PlayMetaFile
PatBlt
SetPixel
EnumFontFamiliesExA
CreateCompatibleBitmap
CreateCompatibleDC
GetObjectA
BitBlt
DeleteDC
DeleteMetaFile
GetTextExtentPoint32A
GetStockObject
Rectangle
CreateRectRgn
GetDeviceCaps
CreateFontIndirectA
CreateSolidBrush
DeleteObject
SaveDC
SelectObject
SetBkMode
SetTextColor
TextOutA
RestoreDC
SetMapMode
UnrealizeObject
GetSystemPaletteEntries
CreatePatternBrush
SelectClipRgn
SetStretchBltMode
SelectPalette
RealizePalette
CreateDIBitmap
CreatePalette
SetMetaFileBitsEx
advapi32
RegQueryValueExA
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
SetFileSecurityA
IsValidSecurityDescriptor
GetFileSecurityA
RegCloseKey
OpenThreadToken
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyExA
OpenSCManagerA
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
CloseServiceHandle
RegDeleteKeyA
RegEnumValueA
RegEnumKeyExA
RegConnectRegistryA
RegDeleteValueA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
shell32
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ole32
OleSaveToStream
OleLoadFromStream
CreateStreamOnHGlobal
StgCreateDocfile
StgOpenStorage
StringFromCLSID
GetRunningObjectTable
CreateItemMoniker
CoCreateGuid
ProgIDFromCLSID
CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoRevokeClassObject
CoRegisterPSClsid
CoRegisterClassObject
CoGetInterfaceAndReleaseStream
CoReleaseMarshalData
CoCreateInstance
CLSIDFromProgID
CoTaskMemFree
CLSIDFromString
StringFromGUID2
WriteClassStm
oleaut32
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal
VariantClear
SysStringLen
SysAllocString
SysFreeString
SysAllocStringLen
VariantCopy
VariantCopyInd
VariantInit
SetErrorInfo
CreateErrorInfo
SysReAllocStringLen
VariantChangeType
LoadTypeLi
SafeArrayPutElement
SafeArrayDestroy
SafeArrayGetElement
SafeArrayCreate
SysStringByteLen
SysAllocStringByteLen
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayCopy
SafeArrayGetDim
RegisterTypeLi
SafeArrayRedim
DispGetParam
VARIANT_UserSize
VARIANT_UserMarshal
VARIANT_UserUnmarshal
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserSize
VARIANT_UserFree
GetErrorInfo
rpcrt4
UuidCreate
UuidFromStringA
NdrDllGetClassObject
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
NdrOleFree
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
NdrStubForwardingFunction
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrProxyErrorHandler
NdrClearOutParameters
NdrProxyFreeBuffer
NdrPointerUnmarshall
NdrConvert
NdrProxySendReceive
NdrInterfacePointerMarshall
NdrProxyGetBuffer
NdrInterfacePointerBufferSize
RpcRaiseException
NdrProxyInitialize
NdrPointerFree
NdrInterfacePointerFree
NdrPointerMarshall
NdrStubGetBuffer
NdrPointerBufferSize
NdrInterfacePointerUnmarshall
NdrStubInitialize
NdrUserMarshalUnmarshall
NdrUserMarshalMarshall
NdrUserMarshalBufferSize
NdrUserMarshalFree
NdrSimpleTypeMarshall
NdrSimpleTypeUnmarshall
NdrSimpleStructMarshall
NdrSimpleStructBufferSize
NdrSimpleStructUnmarshall
winmm
mciSendCommandA
sndPlaySoundA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE