Static task
static1
Behavioral task
behavioral1
Sample
0f3cfe86894c5923b7bf5cdfbc6586bc_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0f3cfe86894c5923b7bf5cdfbc6586bc_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
0f3cfe86894c5923b7bf5cdfbc6586bc_JaffaCakes118
-
Size
120KB
-
MD5
0f3cfe86894c5923b7bf5cdfbc6586bc
-
SHA1
803ba5724c424301317f5eee11d847f377d0f1bc
-
SHA256
a23c2f91a0609cb7c5f297a5f35c65e7c950406041b8e1c9a30eaededaf391c6
-
SHA512
f73dcc53c3fe7cfe47c1f38498f80511102eae489e1f02a78ee31290dfb00051ea4136aad1e8afa59ad2208cf6d7ffb1bc15720344e6ae0364370aa2e8294ba7
-
SSDEEP
3072:+TF8aj8PecYOt/p2F+q8BiGW/j8lDMZ3sDDUjsRPXWA:4bImcFtpG+DW/8fHlD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f3cfe86894c5923b7bf5cdfbc6586bc_JaffaCakes118
Files
-
0f3cfe86894c5923b7bf5cdfbc6586bc_JaffaCakes118.dll windows:4 windows x86 arch:x86
3ad41c3754b4ec6f99ce2803859f5533
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WaitForSingleObject
GetCurrentThread
lstrcmpiW
lstrcatW
SearchPathW
SetEvent
ExpandEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
lstrcpyA
SearchPathA
LoadLibraryW
GetModuleFileNameW
SetFilePointer
GetModuleHandleA
CreateEventA
CreateSemaphoreA
lstrcmpA
GetModuleHandleW
LockFile
FormatMessageW
GetVersion
RaiseException
TlsFree
ExitProcess
GetLocalTime
FormatMessageA
CreateFileA
GetWindowsDirectoryA
ReleaseMutex
UnlockFile
LoadLibraryA
WriteFile
ReleaseSemaphore
LocalAlloc
Sleep
lstrcmpW
lstrcatA
MultiByteToWideChar
VirtualQueryEx
GetModuleFileNameA
LocalFree
InterlockedExchange
CreateSemaphoreW
DisableThreadLibraryCalls
GetLogicalDrives
GetFileAttributesW
GetTickCount
DeviceIoControl
GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
HeapSize
GetCPInfo
InterlockedIncrement
CloseHandle
GetProcessHeap
lstrcpyW
GetProcAddress
SetErrorMode
LoadLibraryExW
HeapDestroy
lstrcmpiA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GlobalFree
GetVersionExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
lstrcpynA
GlobalUnlock
GetCurrentProcess
lstrlenA
InterlockedDecrement
WideCharToMultiByte
lstrlenW
GetCommandLineA
CreateDirectoryA
VirtualProtect
GetOEMCP
GetACP
GetEnvironmentStringsW
GetLastError
FreeEnvironmentStringsW
GetEnvironmentStrings
HeapAlloc
HeapFree
RtlUnwind
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
VirtualQuery
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetSystemInfo
user32
CharNextA
PeekMessageW
wsprintfA
wsprintfW
KillTimer
SetTimer
CallNextHookEx
SetWindowsHookExA
advapi32
GetSidSubAuthority
GetSidSubAuthorityCount
RegOpenKeyExA
IsValidSid
GetUserNameW
RegOpenKeyW
RegCreateKeyExW
RegSetValueExW
RegSetValueExA
RegDeleteKeyW
RegEnumKeyExW
RegEnumKeyExA
RegisterEventSourceW
RegEnumValueW
DeregisterEventSource
RegOpenKeyExW
GetTokenInformation
OpenThreadToken
ReportEventW
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyA
RegDeleteValueA
RegDeleteKeyA
RegCloseKey
RegCreateKeyExA
GetSidIdentifierAuthority
ole32
CoTaskMemRealloc
CoImpersonateClient
CoRevertToSelf
StringFromCLSID
CoTaskMemFree
Sections
.text Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ