_Run@0
Static task
static1
Behavioral task
behavioral1
Sample
21b04a59727204b914a3eda03d148900_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
21b04a59727204b914a3eda03d148900_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
21b04a59727204b914a3eda03d148900_JaffaCakes118
-
Size
328KB
-
MD5
21b04a59727204b914a3eda03d148900
-
SHA1
19faa14dc859804bdf88ccfb520a6c8118e4f5a8
-
SHA256
bc59e708063e32e5b8cf67f22a5b4c2ff86dddd51ebcf1cd8424c491c3045c63
-
SHA512
775bb669b028788ed2890c11a578cc6dd2e1c32e33aabfab459d0b2236d4ebe788cf1bf6cab73307e9d55339649f70c7836a47c77e7bed5ea0dd33b6f1b9245e
-
SSDEEP
6144:+Ey9AhIWwwhH2bjcxyUgIe8xtND/RHumwOfAysEBojfiyVbVX81ogUgfQDpf3hD:dhI/wEfcs6DZH4wiEBfyJVsq8m53hD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 21b04a59727204b914a3eda03d148900_JaffaCakes118
Files
-
21b04a59727204b914a3eda03d148900_JaffaCakes118.dll windows:4 windows x86 arch:x86
c69e7c5c6b975b5dd44f2d4469eea107
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
atol
memset
_chkstk
shlwapi
StrCatW
wnsprintfA
StrCpyW
StrStrIA
wininet
InternetReadFile
InternetOpenA
InternetCloseHandle
InternetOpenUrlA
shell32
Shell_NotifyIconA
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
kernel32
CloseHandle
LockResource
VirtualAlloc
GetLastError
CreateFileW
GetComputerNameA
CreateMutexW
lstrlenA
lstrcpynA
WaitForSingleObject
GetTickCount
VirtualFree
InitializeCriticalSection
GetVolumeInformationA
Sleep
lstrcatA
lstrlenW
GetTempPathW
DisableThreadLibraryCalls
GetModuleFileNameA
lstrcatW
DeleteCriticalSection
CreateThread
lstrcpyA
GetTempFileNameW
CreateFileA
GetFileSize
SetFilePointer
FindResourceW
LoadResource
CreateProcessW
GetCurrentProcess
WriteFile
ReadFile
SizeofResource
GetFileAttributesA
user32
DispatchMessageW
FindWindowA
SendMessageW
PostMessageA
IsWindow
ShowWindow
EndDialog
GetWindowTextW
LoadIconW
IsDialogMessageW
TranslateMessage
EnumWindows
wsprintfA
KillTimer
PostMessageW
GetMessageW
CreateDialogParamA
SetTimer
advapi32
RegCloseKey
InitiateSystemShutdownW
AdjustTokenPrivileges
RegOpenKeyA
LookupPrivilegeValueW
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
OpenProcessToken
ole32
CoInitialize
CoCreateInstance
Exports
Exports
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tlsc Size: 304KB - Virtual size: 303KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ndaoc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE