Static task
static1
Behavioral task
behavioral1
Sample
199a4f39ce9130101c5ffb9dbb5c1885_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
199a4f39ce9130101c5ffb9dbb5c1885_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
199a4f39ce9130101c5ffb9dbb5c1885_JaffaCakes118
-
Size
86KB
-
MD5
199a4f39ce9130101c5ffb9dbb5c1885
-
SHA1
6ab219b5871ba49057925a89f9647a8f049eb66b
-
SHA256
d974c9a8a07820d6c5c286a8f0b7e334ef5254aed2d1681ef71796dd70c54b87
-
SHA512
3e1cd3565bd32ba52aba7190a081e85968df2c56f68f0b8e28bef0383dbf8c74aa131248f15c1dafa7d6f789e00665267c292c25c54ac5bb06fd2426a881ec52
-
SSDEEP
1536:EeyePgZEEpfgcMbJ+GObY5cfcEJqCx3UCs/BIgSy2pVb3n0YbsFKrILoAU:EEQ4cY0GObYmfcEJY1IgG30PFYDT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 199a4f39ce9130101c5ffb9dbb5c1885_JaffaCakes118
Files
-
199a4f39ce9130101c5ffb9dbb5c1885_JaffaCakes118.dll windows:4 windows x86 arch:x86
bfc683bc1c70a2bb146e550f90627c92
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Beep
CloseHandle
CreateFileMappingA
CreateFileW
CreateJobObjectA
CreateMutexW
CreateTimerQueue
DeleteTimerQueueTimer
EnterCriticalSection
EnumCalendarInfoExW
ExitProcess
FindNextVolumeA
FindNextVolumeMountPointW
GetACP
GetBinaryTypeA
GetCommandLineA
GetDefaultCommConfigW
GetExitCodeProcess
GetModuleHandleA
GetOEMCP
GetPrivateProfileStringW
GetStartupInfoA
GetThreadPriority
GetThreadPriorityBoost
GetThreadTimes
GetTimeFormatW
GetVersionExA
Heap32Next
HeapAlloc
HeapCreate
HeapValidate
IsBadReadPtr
IsBadStringPtrA
LocalSize
MapUserPhysicalPages
MapViewOfFile
OpenFile
OpenSemaphoreA
ResetWriteWatch
SetFileAttributesA
SetFileAttributesW
SetLastError
SetStdHandle
WaitForMultipleObjects
WritePrivateProfileStructA
_llseek
_lopen
lstrcpyA
user32
SetWindowPlacement
UnionRect
SetDlgItemTextA
TrackPopupMenu
SetWindowLongA
ReleaseCapture
RegisterClassA
PostQuitMessage
MsgWaitForMultipleObjects
LoadIconA
InvalidateRgn
IntersectRect
GetWindowRect
GetWindowDC
GetUserObjectSecurity
GetParent
GetMenuItemCount
GetMenu
GetFocus
GetDlgItemTextA
GetDlgItem
EmptyClipboard
DrawEdge
DestroyWindow
DeferWindowPos
DefFrameProcA
DefDlgProcA
CreateWindowExA
ClientToScreen
CheckMenuItem
SetMenuItemInfoA
msi
MsiOpenPackageW
MsiInstallMissingFileW
MsiOpenProductA
MsiPreviewDialogW
MsiProvideAssemblyA
MsiViewGetErrorW
MsiViewExecute
MsiViewClose
MsiVerifyPackageA
MsiInstallMissingFileA
MsiInstallMissingComponentW
MsiGetFeatureUsageW
MsiEvaluateConditionW
MsiEnumPatchesA
MsiEnumComponentQualifiersA
MsiEnableUIPreview
MsiEnableLogA
MsiProcessAdvertiseScriptA
MsiDoActionW
MsiDeleteUserDataW
MsiDatabaseOpenViewA
MsiDatabaseIsTablePersistentW
MsiDatabaseExportW
MsiDatabaseExportA
MsiCreateTransformSummaryInfoW
MsiCreateAndVerifyInstallerDirectory
MsiCollectUserInfoW
MsiAdvertiseProductA
Migrate10CachedPackagesA
MsiSetComponentStateW
MsiSetComponentStateA
MsiReinstallProductW
MsiRecordSetStreamA
MsiRecordSetInteger
MsiQueryProductStateA
oleacc
WindowFromAccessibleObject
AccessibleChildren
oledlg
OleUIAddVerbMenuA
OleUIBusyA
OleUICanConvertOrActivateAs
OleUIChangeIconA
dbghelp
SymFunctionTableAccess64
SymFromAddr
SymGetSymNext64
SymGetTypeFromName
SymGetSymFromName64
SymFindFileInPath
FindFileInSearchPath
comctl32
FlatSB_SetScrollProp
InitCommonControls
ImageList_Write
ImageList_SetOverlayImage
ImageList_SetFlags
ImageList_SetFilter
ImageList_LoadImageW
ImageList_LoadImageA
ImageList_GetImageCount
ImageList_GetIcon
ImageList_GetBkColor
ImageList_Duplicate
ImageList_DrawIndirect
ImageList_DragLeave
ImageList_BeginDrag
ImageList_AddIcon
FlatSB_ShowScrollBar
FlatSB_SetScrollInfo
FlatSB_GetScrollProp
FlatSB_GetScrollPos
DrawStatusTextA
DrawInsert
DestroyPropertySheetPage
CreateStatusWindowA
CreateMappedBitmap
InitMUILanguage
InitializeFlatSB
MenuHelp
PropertySheetW
InitCommonControlsEx
comdlg32
GetOpenFileNameW
dwOKSubclass
dwLBSubclass
WantArrows
GetSaveFileNameW
ChooseFontW
GetSaveFileNameA
CommDlgExtendedError
security
QuerySecurityPackageInfoW
FreeContextBuffer
DeleteSecurityPackageW
DeleteSecurityPackageA
DeleteSecurityContext
AcquireCredentialsHandleW
AddSecurityPackageA
CompleteAuthToken
advapi32
SetSecurityDescriptorDacl
SetNamedSecurityInfoA
ReportEventA
RegisterTraceGuidsW
RegFlushKey
OpenTraceA
OpenServiceA
OpenEventLogW
LsaRemovePrivilegesFromAccount
LsaAddPrivilegesToAccount
LookupSecurityDescriptorPartsW
ImpersonateNamedPipeClient
GetAuditedPermissionsFromAclA
FindFirstFreeAce
EnumServicesStatusExW
ElfRegisterEventSourceW
ElfChangeNotify
DestroyPrivateObjectSecurity
CryptDuplicateKey
CreateServiceA
CreateProcessAsUserA
ConvertToAutoInheritPrivateObjectSecurity
ClearEventLogW
BuildImpersonateExplicitAccessWithNameW
AddAccessAllowedObjectAce
Sections
.text Size: 55KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ