Static task
static1
Behavioral task
behavioral1
Sample
1b3e7b6c7fefdf5fbfeb196e056b8ea0_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1b3e7b6c7fefdf5fbfeb196e056b8ea0_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
1b3e7b6c7fefdf5fbfeb196e056b8ea0_JaffaCakes118
-
Size
56KB
-
MD5
1b3e7b6c7fefdf5fbfeb196e056b8ea0
-
SHA1
8d7c72ac7f67a2ab1dc8d4a49576e87356b2f189
-
SHA256
911e8e401d9329fb9d52eac0224b749e2b079d625335152a8674bb23f9ad98e5
-
SHA512
317506b38d209a7835692dc1a632fee7e83083ed97da5e707cc9d4d9fff1059bea621e297bd2eb699a8a5d1da39dd74a8f0730d9e1417dee7d6080845570974f
-
SSDEEP
1536:6LJ2rfBAN4GoEtL0ujDv44WdYo1boOw/BDrJ3a7EwCEI:P89Po15w/BHJq7E2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b3e7b6c7fefdf5fbfeb196e056b8ea0_JaffaCakes118
Files
-
1b3e7b6c7fefdf5fbfeb196e056b8ea0_JaffaCakes118.dll windows:4 windows x86 arch:x86
b14b1c875c9138e261daf3fcc894c9c0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleFileNameW
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetVersion
GetModuleHandleW
LoadLibraryExW
GetProcAddress
SetUnhandledExceptionFilter
DisableThreadLibraryCalls
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThread
DeviceIoControl
CreateMutexW
CreateThread
ResumeThread
CloseHandle
WaitForSingleObject
LeaveCriticalSection
LocalFree
FormatMessageW
GetSystemTime
VirtualProtect
GetLastError
GetCommandLineA
HeapSize
advapi32
OpenThreadToken
RegCloseKey
AccessCheck
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
ole32
CoCreateInstance
StringFromGUID2
rpcrt4
RpcServerInqBindings
RpcEpRegisterW
RpcStringBindingParseW
RpcStringFreeW
RpcEpUnregister
RpcBindingVectorFree
RpcImpersonateClient
RpcRevertToSelf
msvcrt
??3@YAXPAX@Z
_adjust_fdiv
malloc
memset
_wcsicmp
mbstowcs
_onexit
_lock
__dllonexit
_unlock
_amsg_exit
strtok
__CxxFrameHandler
time
_except_handler3
??2@YAPAXI@Z
free
_initterm
_vsnwprintf
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 33KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ