Static task
static1
Behavioral task
behavioral1
Sample
16c63435c0cd89f4f0299678e4872f28_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
16c63435c0cd89f4f0299678e4872f28_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
16c63435c0cd89f4f0299678e4872f28_JaffaCakes118
-
Size
90KB
-
MD5
16c63435c0cd89f4f0299678e4872f28
-
SHA1
533ebc4f9bf7a0238e8e6daac7ab0da2070615be
-
SHA256
cb9e6efa709f3a53daa3718b6923036129232c848d866a9cc173c70779c02d2a
-
SHA512
49ea953786229b3dea4d10a4821f129ad6453bbb3b67369f89576818ab9a7bbfe5e9147060a74ab913ec6ce7812fc7e9f2e3f7165212a852ebbcb3e2cc8aa418
-
SSDEEP
1536:OVr87TFQNXURfx2nksD641fNi68pN+HimRsMlIiQt5bwgx7sl7zkozG4+wnx4e:beNERUkG641fN10+SuxlXkozVue
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 16c63435c0cd89f4f0299678e4872f28_JaffaCakes118
Files
-
16c63435c0cd89f4f0299678e4872f28_JaffaCakes118.dll windows:4 windows x86 arch:x86
b9004cc466d4651ddee210e085c52b31
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CreateEventA
CreateFileA
CreateThread
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
ExitProcess
ExitThread
FlushFileBuffers
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetACP
GetCPInfo
GetCommandLineA
GetCurrentProcess
GetCurrentThreadId
GetEnvironmentStringsA
GetEnvironmentStringsW
GetExitCodeThread
GetFileType
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDefaultLCID
GetTempFileNameA
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GlobalMemoryStatus
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsDBCSLeadByte
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LocalAlloc
LocalFree
MultiByteToWideChar
ReadFile
RtlUnwind
SetEndOfFile
SetErrorMode
SetEvent
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrlenA
oleaut32
VariantChangeTypeEx
SafeArrayCreate
SafeArrayDestroy
SafeArrayUnaccessData
SysAllocStringLen
SysFreeString
VariantTimeToSystemTime
VariantInit
VariantClear
SafeArrayAccessData
VariantChangeType
SystemTimeToVariantTime
SysStringByteLen
user32
CharUpperA
IsCharAlphaNumericA
LoadStringA
wsprintfA
CharLowerA
odbc32
ord240
ord23
ord254
ord253
ord252
ord51
ord20
ord49
ord265
ord219
ord48
ord18
ord61
ord46
ord245
ord44
ord43
ord242
ord16
ord14
ord3
ord4
ord72
ord5
ord206
ord9
ord210
ord211
ord12
ord13
Sections
.text Size: 76KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ