Static task
static1
Behavioral task
behavioral1
Sample
163061fdd3479300028d2fdd3d9ba744_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
163061fdd3479300028d2fdd3d9ba744_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
163061fdd3479300028d2fdd3d9ba744_JaffaCakes118
-
Size
156KB
-
MD5
163061fdd3479300028d2fdd3d9ba744
-
SHA1
bd4006ef0fd9305a65d42128aadce4e63f93ecfb
-
SHA256
d67b97e48c1b1e9a0a30b81d3423b9952e687937b5bbadbc517b64c6825121cd
-
SHA512
f5209d9b58c546f665ddfc85c64d64b303719b775d772efe80c26ddaa55982af6d7cd7de3bb6aa7b44087a51e4dc6ba214438726f4c4e1c3c06b76f365376306
-
SSDEEP
3072:aDETwJG0dU9X2S7qu3EOdarLhoUL7Zo2lkNr99vHIPZvj+sKABOWcntZipr5TUPJ:nEJdkX2PnNx+x5HIBvj+s1BDcnR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 163061fdd3479300028d2fdd3d9ba744_JaffaCakes118
Files
-
163061fdd3479300028d2fdd3d9ba744_JaffaCakes118.dll windows:4 windows x86 arch:x86
b0ffc5e2e9a0254e2e6a51c50115e00c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetEndOfFile
GetFileSize
SetFilePointer
CreateFileW
GetFileTime
DeleteCriticalSection
WriteFile
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
InterlockedCompareExchange
DisableThreadLibraryCalls
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrcpyA
lstrcpyW
lstrcmpiA
CompareStringA
GlobalAlloc
MapViewOfFile
lstrlenW
CreateFileMappingW
lstrcmpW
OutputDebugStringA
SetLastError
GetTickCount
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
CreateEventA
SetEvent
WaitForSingleObject
GetProcessHeap
lstrlenA
HeapAlloc
HeapFree
HeapReAlloc
WideCharToMultiByte
VirtualAlloc
ReadFile
lstrcmpiW
InterlockedExchange
Sleep
GetProcAddress
EnterCriticalSection
LoadLibraryW
MultiByteToWideChar
GetLastError
LeaveCriticalSection
GetCurrentThread
GetCurrentProcess
CloseHandle
GlobalFree
GetCommandLineA
VirtualProtect
GetSystemTimeAsFileTime
user32
wsprintfW
wsprintfA
advapi32
AllocateAndInitializeSid
LsaQueryInformationPolicy
LsaNtStatusToWinError
LsaOpenPolicy
LsaRetrievePrivateData
LsaFreeMemory
RegCloseKey
TraceMessage
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
CryptDestroyKey
SetSecurityDescriptorDacl
AddAccessDeniedAceEx
AddAccessAllowedAce
EqualSid
GetAce
InitializeAcl
GetSecurityDescriptorDacl
GetTokenInformation
LookupPrivilegeValueW
OpenProcessToken
OpenThreadToken
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
CopySid
GetLengthSid
AddAuditAccessAce
MakeSelfRelativeSD
SetSecurityDescriptorSacl
SetSecurityDescriptorGroup
GetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetSecurityDescriptorOwner
AddAccessDeniedAce
SetSecurityDescriptorControl
FreeSid
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
CryptExportKey
ControlService
CloseServiceHandle
QueryServiceStatus
rpcrt4
NdrCStdStubBuffer_Release
msvcr71
sprintf
__dllonexit
__CppXcptFilter
_XcptFilter
_except_handler3
_CxxThrowException
free
wcslen
wcscmp
malloc
memmove
strchr
_onexit
_strnicmp
atol
atoi
memset
memcpy
__CxxFrameHandler
_adjust_fdiv
_initterm
Sections
.text Size: 100KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ