Static task
static1
Behavioral task
behavioral1
Sample
198b1b11aedc2bfad17333e1e173d0fd_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
198b1b11aedc2bfad17333e1e173d0fd_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
198b1b11aedc2bfad17333e1e173d0fd_JaffaCakes118
-
Size
58KB
-
MD5
198b1b11aedc2bfad17333e1e173d0fd
-
SHA1
91e557fb735a90768e4535917073078465730773
-
SHA256
a9b28022858047755d1c456000ae94e7637e82947d41c393f137a03cc56d44ba
-
SHA512
acabcba7466674b95fa472ece329d424ea80d569f5f1b72a81882c7266d0c8030c37fe3c87760e8453812c65a824f3afa8e875419096902e81a5c8fed76bd3a2
-
SSDEEP
1536:nF333qtlkzo4ZqpeX9z66f2VHSakOwV37ApJP696Nb3lnUS+x6yjMN+/y9gO:J34lkzo4Zqpes6f2VHbLwV37ApJC96NW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 198b1b11aedc2bfad17333e1e173d0fd_JaffaCakes118
Files
-
198b1b11aedc2bfad17333e1e173d0fd_JaffaCakes118.dll windows:4 windows x86 arch:x86
6df603219630c558f22346738296ee32
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
OpenProcess
GetProcAddress
GetModuleHandleA
GetVersionExA
DeleteFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
lstrcpyA
ExitThread
TerminateThread
WaitForMultipleObjects
CreateMailslotA
GetModuleFileNameA
WaitForSingleObject
IsBadReadPtr
ReadFile
lstrcatA
Sleep
lstrlenA
GetSystemDirectoryA
CreateDirectoryA
SetFilePointer
GetTickCount
GetTempFileNameA
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc
LoadLibraryA
ReleaseMutex
GetModuleHandleW
CreateEventA
CreateMutexW
MultiByteToWideChar
CreateThread
FindClose
FindNextFileA
lstrcmpA
ResetEvent
CompareStringA
GetLastError
GetFileAttributesA
FindFirstFileA
SetFileAttributesA
CreateFileA
WriteFile
CloseHandle
SetEndOfFile
SetEvent
user32
wsprintfA
GetForegroundWindow
gdi32
GetStockObject
advapi32
RegOpenKeyExA
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
RegNotifyChangeKeyValue
RegCreateKeyExA
RegSetValueExA
CreateProcessAsUserA
InitializeSecurityDescriptor
CryptDeriveKey
CryptHashData
RegOpenCurrentUser
RegQueryValueExA
RegCloseKey
RevertToSelf
CryptCreateHash
CryptAcquireContextA
CryptDecrypt
CryptEncrypt
iphlpapi
GetAdaptersInfo
shell32
SHGetFolderPathA
Sections
.text Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ