?service_thread@@YGKPAX@Z
Static task
static1
Behavioral task
behavioral1
Sample
272dc79e34f75c7f09318dbbf2c05f56_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
272dc79e34f75c7f09318dbbf2c05f56_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
272dc79e34f75c7f09318dbbf2c05f56_JaffaCakes118
-
Size
128KB
-
MD5
272dc79e34f75c7f09318dbbf2c05f56
-
SHA1
30627fd22235954b697fa3836521374fb557a684
-
SHA256
5a335c74464ae7ccd778de2a7feaf87e1c3f9c25dd19203d9ca2e6686dc79bb3
-
SHA512
b6a20bf80d52c6b984d209b14e7ef15e6959cc3a7fbdfaf00571f287fe550ed49071e05bd973db9d4f4673ddbd3bf3a84f396516ffdafbbb8e8b2286cec0e9b6
-
SSDEEP
1536:mVkwnUsXFJn2vLt9IA3HFtJEqLaoXJDCnabcNbn4gvyun5LnGfU7lmcTqjot:gXHIPlvXJDoeEiunBGc7lPTEo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 272dc79e34f75c7f09318dbbf2c05f56_JaffaCakes118
Files
-
272dc79e34f75c7f09318dbbf2c05f56_JaffaCakes118.dll windows:4 windows x86 arch:x86
d7ea04f6e9a24d3a94480b0d5415df43
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExitProcess
GetStartupInfoA
TerminateProcess
GetLastError
CloseHandle
CreateThread
LoadLibraryA
GetCurrentProcessId
lstrcpynA
DisableThreadLibraryCalls
HeapSize
lstrcatA
GetProcAddress
lstrlenA
lstrcpyA
WriteFile
lstrcmpA
GetSystemInfo
RtlUnwind
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetCurrentProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetACP
GetOEMCP
GetCPInfo
InitializeCriticalSection
InterlockedExchange
VirtualQuery
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
LCMapStringA
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
VirtualProtect
advapi32
RegOpenKeyA
RegCloseKey
RegCreateKeyA
RegSetValueExA
RegQueryValueExA
ole32
CoCreateGuid
Exports
Exports
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ