Static task
static1
Behavioral task
behavioral1
Sample
21c2240511798118fff161f5afbffe8d_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
21c2240511798118fff161f5afbffe8d_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
21c2240511798118fff161f5afbffe8d_JaffaCakes118
-
Size
119KB
-
MD5
21c2240511798118fff161f5afbffe8d
-
SHA1
ef1d8c2b386bcee7ac5762dad967894fce587ede
-
SHA256
c2526e2a626bcec808a329bea53cf9250c74125649d42b8898d6ac10a27966dd
-
SHA512
0c0790101e1839697f69c7ef3ba789b9c248184ddb9f6406e42fcd2939807cc29fb4f526e5fff5d43936e5f82ca163b258f81378abb4f025b3c8a32ab6954ca2
-
SSDEEP
3072:d7SXrCty1eFhssgullLMtsQd1LmSZuI7vhxP6NHJIQd0O/TzOwQB:d7SXrRgt7LMtsqzuYvhto7awO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 21c2240511798118fff161f5afbffe8d_JaffaCakes118
Files
-
21c2240511798118fff161f5afbffe8d_JaffaCakes118.dll windows:4 windows x86 arch:x86
1976746ca47e93b1d4ea14e6509d9c9a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DebugBreak
GetVersionExW
CopyFileW
lstrcatW
LocalAlloc
GetComputerNameW
lstrcmpiW
HeapFree
HeapAlloc
GetProcessHeap
lstrcpyW
lstrcpynW
SetUnhandledExceptionFilter
GetCurrentThread
lstrcmpW
DeleteFileW
CopyFileA
lstrlenA
WritePrivateProfileSectionA
LocalFree
UnhandledExceptionFilter
WideCharToMultiByte
GetConsoleOutputCP
MultiByteToWideChar
GetCurrentProcess
TerminateProcess
GetProcAddress
GetVersionExA
GetLastError
SetFilePointer
GetFileSize
SetLastError
lstrlenW
GetLocaleInfoA
LoadLibraryA
GlobalAlloc
CreateFileA
CreateFileW
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
ReadFile
GetLocalTime
GetCurrentProcessId
IsValidLocale
InterlockedExchange
Sleep
DisableThreadLibraryCalls
InitializeCriticalSection
GetSystemInfo
InterlockedIncrement
VirtualProtect
GlobalFree
GetCommandLineA
CloseHandle
user32
wsprintfW
wsprintfA
advapi32
RegSaveKeyW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RegCloseKey
RegOpenKeyExW
RegConnectRegistryW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LsaNtStatusToWinError
OpenProcessToken
OpenThreadToken
RegRestoreKeyA
RegRestoreKeyW
LsaClose
LsaQueryInformationPolicy
LsaOpenPolicy
LookupAccountNameW
GetSidSubAuthorityCount
GetLengthSid
LsaFreeMemory
LsaRetrievePrivateData
LookupPrivilegeValueW
RegQueryValueExW
CloseServiceHandle
ole32
CoInitializeEx
CoCreateInstanceEx
CoCreateInstance
CoUninitialize
rpcrt4
RpcBindingFree
NdrClientCall2
RpcStringFreeW
UuidFromStringW
UuidToStringW
msvcr71
mbstowcs
__dllonexit
__CppXcptFilter
_initterm
swprintf
_wcsicmp
wcstoul
time
iswctype
wcscmp
_wcsnicmp
atoi
wcsspn
_except_handler3
_adjust_fdiv
wcscpy
wcsncpy
free
malloc
memcpy
memset
memcmp
strchr
_onexit
memmove
_wcsupr
wcstombs
calloc
sprintf
vsprintf
wcsstr
wcscat
wcslen
Sections
.text Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ