Exucute
Static task
static1
Behavioral task
behavioral1
Sample
1b2a845226aa3a1c57b6d82c0ef5d10b_JaffaCakes118.dll
Resource
win7-20240508-en
General
-
Target
1b2a845226aa3a1c57b6d82c0ef5d10b_JaffaCakes118
-
Size
53KB
-
MD5
1b2a845226aa3a1c57b6d82c0ef5d10b
-
SHA1
52258ab52c32355020c06fd8f378cdf66e237763
-
SHA256
0ecb9ac7a7f1063fcdbd086f9e2d142f22a3a12261d03d10cd9ead6012a33c5a
-
SHA512
17e49c82b24232050eb794e0f5d39a30a091d5977f7b99020a34d0fdcc111bf75b701bca467b62af12255a6014946db135626613ad6adf9362fb3581dbbb8a3e
-
SSDEEP
768:DNpCymKHX3/5hea/pSKdvwDPMIUBYh0NdmnTEDd5TvyjehZbtrPuS41JTygH7:D2GHHCU9bw0Qhje5PuxP7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b2a845226aa3a1c57b6d82c0ef5d10b_JaffaCakes118
Files
-
1b2a845226aa3a1c57b6d82c0ef5d10b_JaffaCakes118.dll windows:5 windows x86 arch:x86
9a36bf7d2561daefd227467b3e92d494
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Process32Next
DeviceIoControl
GetModuleHandleA
CreateToolhelp32Snapshot
CloseHandle
DeleteFileA
CreateThread
lstrcpyA
LoadLibraryA
GetTickCount
WriteFile
FreeLibrary
Module32First
Module32Next
LocalAlloc
LocalFree
RemoveDirectoryA
GetProcAddress
CreateDirectoryA
lstrcatA
GetSystemDirectoryA
Sleep
GetProcessHeap
WaitForSingleObject
Process32First
HeapFree
HeapAlloc
CreateFileA
HeapSize
GetStringTypeW
MultiByteToWideChar
GetCurrentThreadId
DecodePointer
GetCommandLineA
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
GetLastError
InterlockedDecrement
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetModuleFileNameW
RtlUnwind
LCMapStringW
IsProcessorFeaturePresent
advapi32
RegEnumKeyA
RegQueryInfoKeyA
RegOpenKeyExA
RegDeleteKeyA
ControlService
OpenSCManagerA
StartServiceA
CreateServiceA
DeleteService
CloseServiceHandle
OpenServiceA
RegCloseKey
Exports
Exports
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ