WinlogonStartShellEvent
Static task
static1
Behavioral task
behavioral1
Sample
2117d49ba7b410898c9e10d62a696449_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2117d49ba7b410898c9e10d62a696449_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
2117d49ba7b410898c9e10d62a696449_JaffaCakes118
-
Size
132KB
-
MD5
2117d49ba7b410898c9e10d62a696449
-
SHA1
55a8268b792d3d8d314d41eb776ef35f180d7467
-
SHA256
b704022dad9bb7e914ad6faa63ccffa7ab151e64b6b8d9d52f0092f31372519a
-
SHA512
d665303ad3da52931df6639fc811d95007bf2bfa8c1f24fb937d89580743491dfda0383b238a62eefffbeb3f97a6eb4f7cde699b5f03ecbcadb3fc78723debd8
-
SSDEEP
3072:wiStst90wloJFzWKWcr+KDYMr2nNI5t3HRMh4Xzz:CS9b0zWq7r2NKHC4/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2117d49ba7b410898c9e10d62a696449_JaffaCakes118
Files
-
2117d49ba7b410898c9e10d62a696449_JaffaCakes118.dll windows:4 windows x86 arch:x86
83ca1e5ab3c2331c4d5bc822f82ce1b8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FindNextFileA
FindFirstFileA
GetComputerNameA
WriteFile
CreateFileA
LockResource
SizeofResource
LoadResource
FindResourceA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetProcAddress
LoadLibraryA
GetCurrentProcess
GetSystemInfo
FlushFileBuffers
SetStdHandle
GetOEMCP
GetACP
SetFilePointer
GetStringTypeW
GetStringTypeA
RtlUnwind
OpenProcess
ReadProcessMemory
WriteProcessMemory
CloseHandle
lstrlenA
VirtualQueryEx
CreateThread
GetCPInfo
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
Sleep
InterlockedDecrement
InterlockedIncrement
HeapAlloc
HeapFree
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
user32
UnhookWindowsHookEx
FindWindowA
GetWindowThreadProcessId
SetWindowsHookExA
EnumWindows
CallNextHookEx
PtInRect
GetWindowRect
SendMessageA
GetClassNameA
GetKeyNameTextA
GetKeyState
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
ws2_32
WSACleanup
send
recv
connect
htons
gethostbyname
socket
WSAStartup
closesocket
Exports
Exports
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
vshare Size: 4KB - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ