Static task
static1
Behavioral task
behavioral1
Sample
22f5e5a792a74da2975895eed5c81640_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
22f5e5a792a74da2975895eed5c81640_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
22f5e5a792a74da2975895eed5c81640_JaffaCakes118
-
Size
89KB
-
MD5
22f5e5a792a74da2975895eed5c81640
-
SHA1
f5133302b03dc1a4421f8313eb27da55a2403a2c
-
SHA256
b8879b84d3055f7e486b10d9f0fc7bcc3d9748810c21e6529c3b594c85f84aaf
-
SHA512
784f0558f2523fbac7024ac70b2eb9b07201828df9fdff8d96d65f76e65734bcfc422bd87b044211e673fadfaf2a0b6fa2881561cae2b88b810bd0a59636fc5d
-
SSDEEP
1536:Fao/W4PZdeQauTnlbpMRJE8pbWgaE/GSwIdWwgoUD4vA7jnmDwRfojeoLoZW0y:Iou4PPew1f8pbvulIPIDWA7jneHjeoLa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 22f5e5a792a74da2975895eed5c81640_JaffaCakes118
Files
-
22f5e5a792a74da2975895eed5c81640_JaffaCakes118.dll windows:4 windows x86 arch:x86
f7b37dabb17ac091ae973663a42a4c95
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
GetProcAddress
LoadLibraryW
InterlockedCompareExchange
WideCharToMultiByte
GetModuleFileNameA
GetModuleHandleA
InterlockedExchange
FreeLibrary
CloseHandle
UnmapViewOfFile
CreateFileA
DeleteFileA
WriteFile
InterlockedIncrement
InterlockedDecrement
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
lstrcatA
CompareStringA
lstrlenA
GetSystemDefaultLangID
GetVersionExA
VirtualProtect
WinExec
lstrcmpiA
GlobalFree
GetWindowsDirectoryA
GetCommandLineA
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
HeapAlloc
HeapFree
RtlUnwind
GetVersion
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStringTypeW
user32
wsprintfA
GetSystemMetrics
WinHelpA
advapi32
RegDeleteKeyA
RegSetValueA
RegQueryValueA
RegOpenKeyA
RegQueryInfoKeyA
RegEnumKeyA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
ole32
CoGetClassObject
StringFromCLSID
CreateFileMoniker
CLSIDFromProgID
CoTaskMemFree
CLSIDFromString
CoCreateInstance
Sections
.text Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ