Static task
static1
Behavioral task
behavioral1
Sample
2366e6b781f2621df4873ebe0f299a16_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2366e6b781f2621df4873ebe0f299a16_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
2366e6b781f2621df4873ebe0f299a16_JaffaCakes118
-
Size
179KB
-
MD5
2366e6b781f2621df4873ebe0f299a16
-
SHA1
423fd10080139672c1991385a5a07d49c585abbc
-
SHA256
d5da85e04ea6cefc3a65e20bbfbba57afe6a249443e12eaf25bd4169e513ac96
-
SHA512
8f72e0e64d24df9615b59f5eb9a1f436d5ace9173654da502b6abc2a62633d26d5fa61c2e43d0589ef2fb6b93d041850fc02d90d761a06086d5a130718381d59
-
SSDEEP
3072:oe0+CQ2bpfKXZ1zC/WfsOGAbrzHJ+h4Yph24d2kfyIiukSBGafogriC9BDMqqDLU:o9+CQ2bpfM1u/WfsOGAbrzHJ+h4Yph2i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2366e6b781f2621df4873ebe0f299a16_JaffaCakes118
Files
-
2366e6b781f2621df4873ebe0f299a16_JaffaCakes118.dll windows:4 windows x86 arch:x86
97f6da5756d43f170c64407f982a2c3d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
MultiByteToWideChar
InterlockedCompareExchange
Sleep
InterlockedExchange
GlobalFree
GlobalAlloc
WaitForSingleObject
WriteFile
CreateEventA
lstrlenA
CreateFileW
GetTempFileNameW
GetTickCount
GetModuleFileNameA
lstrcatA
lstrcpyA
CloseHandle
InterlockedDecrement
InterlockedIncrement
lstrlenW
GetVersionExA
GetProcAddress
LocalAlloc
LocalFree
LoadLibraryExA
LoadLibraryA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LoadLibraryW
DisableThreadLibraryCalls
VirtualProtect
DeleteFileW
GetCommandLineA
user32
CharNextA
wsprintfW
CopyRect
ReleaseDC
GetDC
BeginPaint
MapWindowPoints
GetWindowRect
OffsetRect
EndPaint
ClientToScreen
SetRect
GetPropA
ShowWindow
GetParent
GetSysColor
FillRect
GetClientRect
GetDlgItem
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
gdi32
StretchBlt
SetBkColor
DeleteObject
DeleteDC
SetTextColor
BitBlt
CreateSolidBrush
CreateCompatibleDC
SelectObject
SelectPalette
RealizePalette
ole32
CoTaskMemFree
StringFromCLSID
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemAlloc
msvcrt
__CxxFrameHandler
malloc
_adjust_fdiv
free
_initterm
_vsnprintf
_amsg_exit
_XcptFilter
wcslen
wcscpy
_except_handler3
Sections
.text Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ