Static task
static1
Behavioral task
behavioral1
Sample
15b86cbe80ef05ccfd16f8b678735d53_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
15b86cbe80ef05ccfd16f8b678735d53_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
15b86cbe80ef05ccfd16f8b678735d53_JaffaCakes118
-
Size
36KB
-
MD5
15b86cbe80ef05ccfd16f8b678735d53
-
SHA1
b79b6343203e2afdbe322a991828d256f0243e92
-
SHA256
6738d4cd71e59a19766714a4480e185249dbe58910817df673bd879e2e73985f
-
SHA512
be03eace04e016aac3b31949d466f6a929fe481c1d017a8fc7c0aa9e9620f0aff37b4b9a70159dcd2f6ec81c40424d00f4d6517553fc75316e2bb726b341fdca
-
SSDEEP
768:Q/o1HkRnToXL2awnYS708/fmci/r96aGZXodcjpEd1/aF5QM:u4HkRTOL2aGYS5/uB/rwYHcQM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 15b86cbe80ef05ccfd16f8b678735d53_JaffaCakes118
Files
-
15b86cbe80ef05ccfd16f8b678735d53_JaffaCakes118.dll windows:1 windows x86 arch:x86
52eba74c608a7be32677c42801c375e8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
gdi32
MoveToEx
kernel32
CloseHandle
CreateFileA
CreateThread
DeleteFileA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FreeEnvironmentStringsA
GetCommandLineA
GetCurrentThreadId
GetEnvironmentStringsA
GetEnvironmentVariableA
GetExitCodeThread
GetFileSize
GetFileType
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetStringTypeA
GetVersionExA
GetVolumeInformationA
GlobalAlloc
GlobalFree
GlobalReAlloc
MoveFileA
MultiByteToWideChar
OpenProcess
ReadFile
ResumeThread
SetEndOfFile
SetEnvironmentVariableA
SetErrorMode
SetFilePointer
SetLastError
Sleep
SuspendThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
WideCharToMultiByte
WriteFile
CreateMutexA
CreateRemoteThread
FlushInstructionCache
FreeLibraryAndExitThread
GetCurrentProcess
IsBadStringPtrA
OpenMutexA
VirtualAllocEx
VirtualFreeEx
VirtualProtect
WriteProcessMemory
lstrcmpiA
lstrlenA
RtlMoveMemory
CreateToolhelp32Snapshot
Process32First
Process32Next
ole32
CLSIDFromProgID
CoCreateInstance
CoInitialize
CoUninitialize
ProgIDFromCLSID
oleaut32
GetActiveObject
SafeArrayCreate
SysAllocStringByteLen
SysFreeString
SysStringByteLen
VariantClear
VariantCopy
user32
CharLowerBuffA
CharNextA
CharUpperBuffA
CreateDialogIndirectParamA
CreateDialogParamA
CreateWindowExA
DialogBoxIndirectParamA
DialogBoxParamA
GetWindow
urlmon
URLDownloadToFileA
wininet
InternetOpenA
InternetCloseHandle
InternetConnectA
InternetOpenUrlA
InternetReadFile
DeleteUrlCacheEntry
Sections
.text Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.link Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rloc Size: 1024B - Virtual size: 852B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ