Static task
static1
Behavioral task
behavioral1
Sample
23eaad9d57061ff7c5b87794107d6a53_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
23eaad9d57061ff7c5b87794107d6a53_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
23eaad9d57061ff7c5b87794107d6a53_JaffaCakes118
-
Size
232KB
-
MD5
23eaad9d57061ff7c5b87794107d6a53
-
SHA1
3cba37a764bfd1302f59af504a2a41cd3c43c742
-
SHA256
d06e6d5422c75f4cb33a5f0cec709fe8e032abcdfc73748acd192f2bcb2b4c53
-
SHA512
9d35a444a590f8362353d3740c7102cb7501640d69ca8cfab5a662d6f0e2da611652e8c586c05a4022e350ba008515f9b5bf7cecea930e53355b4ae50e394843
-
SSDEEP
6144:7/rkCQx1u9icmkXUfxUXx4qqDLu32IKIW:7U1VksxUfqnuG3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 23eaad9d57061ff7c5b87794107d6a53_JaffaCakes118
Files
-
23eaad9d57061ff7c5b87794107d6a53_JaffaCakes118.dll windows:4 windows x86 arch:x86
06f5d19cdbd1f8f3dfaa9c2eeae0f545
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedDecrement
ExpandEnvironmentStringsW
CreateEventW
GetComputerNameW
GetCurrentThread
TerminateThread
ResumeThread
FreeLibraryAndExitThread
ResetEvent
CreateThread
IsBadWritePtr
FreeLibrary
LoadLibraryExW
GetDriveTypeW
LocalAlloc
WaitForSingleObject
GetProcAddress
InterlockedExchange
OpenEventW
DefineDosDeviceW
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemDirectoryW
LoadLibraryW
ReleaseSemaphore
CompareStringW
GetSystemTime
SystemTimeToFileTime
GetStringTypeA
LCMapStringW
LCMapStringA
Sleep
InterlockedCompareExchange
OutputDebugStringA
VirtualProtect
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
SetFileAttributesW
CreateDirectoryW
GetCurrentProcess
CloseHandle
GetEnvironmentVariableW
GetFileAttributesW
FormatMessageW
LocalFree
GetCommandLineA
SetEvent
MultiByteToWideChar
RtlUnwind
GetVersion
ExitProcess
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
IsBadReadPtr
IsBadCodePtr
HeapAlloc
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
GetStringTypeW
user32
wsprintfW
LoadStringW
advapi32
RegFlushKey
DeleteService
OpenServiceW
OpenSCManagerW
CloseServiceHandle
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetLengthSid
RegCloseKey
RegEnumValueW
LsaGetUserName
RegQueryValueExW
SetThreadToken
OpenProcessToken
OpenThreadToken
RegNotifyChangeKeyValue
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
AdjustTokenPrivileges
ole32
CoCreateInstance
StringFromGUID2
Sections
.text Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ