Static task
static1
Behavioral task
behavioral1
Sample
29019f062020b83b2d0cdcf953daa19c_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
29019f062020b83b2d0cdcf953daa19c_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
29019f062020b83b2d0cdcf953daa19c_JaffaCakes118
-
Size
150KB
-
MD5
29019f062020b83b2d0cdcf953daa19c
-
SHA1
81f7c16401a8381f2acad280c95a6a545b632ce2
-
SHA256
d1720ac5558246095a318ea51cfe473072ba8d5d394f1edefc489f87b33ec74f
-
SHA512
5b093e3285d8b1a09e51d6e72cb9076d3e128ca414c97a9cbbf754477168a293e33ed572969efdacf001a4ce56f0e07a3ce1ac5a2f2dd08c76b37edc95dc9716
-
SSDEEP
3072:LZZ1502pZIGYceBYb2YyKvOfVb3bNasxnofsvqQxGrOFw9JFRyrp+4uAwoSxMm:NZ1tpZIXn4q9Fa2ocP0OF7rLuAi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29019f062020b83b2d0cdcf953daa19c_JaffaCakes118
Files
-
29019f062020b83b2d0cdcf953daa19c_JaffaCakes118.dll windows:4 windows x86 arch:x86
ce28ff9b576e4fdd7ebfe7413c33bfe0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExpandEnvironmentStringsW
lstrcatW
SetFileAttributesW
lstrcmpiW
CopyFileW
lstrcpynW
GetProcessHeap
RegisterWaitForSingleObject
InterlockedDecrement
SetEvent
ResetEvent
CreateEventW
SetFilePointer
GetTempFileNameW
GetVolumeNameForVolumeMountPointW
WriteFile
FlushFileBuffers
ReadFile
ReleaseMutex
CreateFileW
CreateMutexW
RemoveDirectoryW
MoveFileW
GetVolumeInformationW
GetSystemDirectoryW
LoadLibraryExW
FormatMessageW
DeleteFileW
LocalAlloc
LocalFree
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
GetOEMCP
GetStringTypeW
GetACP
GetDriveTypeW
GetDiskFreeSpaceExW
GetSystemTimeAsFileTime
QueueUserWorkItem
FreeLibrary
LoadLibraryW
lstrcpyW
lstrlenW
GetCurrentThreadId
GetFileAttributesW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FindFirstFileW
lstrcmpW
HeapDestroy
QueryDosDeviceW
CreateDirectoryW
FindNextFileW
FindClose
lstrlenA
lstrcatA
lstrcpyA
CreateProcessA
CreateDirectoryA
GetSystemDirectoryA
GetSystemInfo
WaitForSingleObject
CloseHandle
GetVolumeInformationA
GetCommandLineA
OpenMutexW
VirtualProtect
GetCPInfo
HeapReAlloc
RtlUnwind
GetVersion
ExitProcess
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapAlloc
VirtualAlloc
user32
GetSystemMetrics
LoadBitmapA
GetKeyboardType
LoadStringW
CharUpperW
wsprintfW
GetSysColor
MessageBoxA
advapi32
RegisterEventSourceW
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyW
RegDeleteValueW
RegSetValueExW
CloseServiceHandle
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
LsaClose
LsaQueryInformationPolicy
SetSecurityInfo
SetEntriesInAclW
AllocateAndInitializeSid
EqualSid
GetAce
GetAclInformation
RegCreateKeyExW
SetThreadToken
RegDeleteKeyW
RegUnLoadKeyW
RegEnumValueW
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegQueryInfoKeyA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
DeregisterEventSource
ole32
CoUninitialize
CoTaskMemFree
Sections
.text Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ