Static task
static1
Behavioral task
behavioral1
Sample
2ddba3914e5cebd5e5b79c2a70e41885_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2ddba3914e5cebd5e5b79c2a70e41885_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2ddba3914e5cebd5e5b79c2a70e41885_JaffaCakes118
-
Size
517KB
-
MD5
2ddba3914e5cebd5e5b79c2a70e41885
-
SHA1
c9851e6b18a9e3a640f02e514c30254257c9e64a
-
SHA256
4d4354614d8a0cf5993ddac528cf0ea4f8e716228f74327943809cd7de8c698b
-
SHA512
1f737197465867b0e112852a547aac9e91f57e0ae0b1a3f2f431efa5f802aaa9b6dc88d5d447cb4fe9e1420f301e97ebf7cf3cebcfab65f92a5f87acd277a615
-
SSDEEP
12288:wTl9gYpPriZRO27KTwEFvdfI8L0bNqEM1:ygq2ROrwElNcBqEI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ddba3914e5cebd5e5b79c2a70e41885_JaffaCakes118
Files
-
2ddba3914e5cebd5e5b79c2a70e41885_JaffaCakes118.dll windows:4 windows x86 arch:x86
775414026b3ba17c6f0ef41c11843c2d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
lstrlenA
lstrcpynA
lstrcpyA
lstrcmpA
WritePrivateProfileStringA
WriteFile
WaitForSingleObject
VirtualQueryEx
VirtualQuery
VirtualAlloc
TerminateThread
TerminateProcess
Sleep
SetLastError
SetFilePointer
SetFileAttributesA
SetEvent
SetEndOfFile
ResumeThread
ResetEvent
RemoveDirectoryA
ReadProcessMemory
ReadFile
QueryPerformanceFrequency
QueryPerformanceCounter
PeekNamedPipe
OpenProcess
MulDiv
MoveFileA
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
HeapFree
HeapAlloc
GlobalUnlock
GlobalReAlloc
GlobalHandle
GlobalLock
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVersionExA
GetTimeZoneInformation
GetTickCount
GetThreadLocale
GetTempPathA
GetSystemInfo
GetSystemDirectoryA
GetStringTypeExA
GetStdHandle
GetShortPathNameA
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetFileAttributesA
GetExitCodeThread
GetEnvironmentVariableW
GetDriveTypeA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetComputerNameA
GetCPInfo
GetACP
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
CreateThread
CreateProcessA
CreatePipe
CreateFileA
CreateEventA
CreateDirectoryA
CompareStringW
CompareStringA
CloseHandle
advapi32
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegFlushKey
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
GetUserNameA
AdjustTokenPrivileges
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
avicap32
capCreateCaptureWindowA
gdi32
UnrealizeObject
StretchBlt
SetWinMetaFileBits
SetTextColor
SetStretchBltMode
SetROP2
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
RealizePalette
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
GetWinMetaFileBits
GetTextMetricsA
GetSystemPaletteEntries
GetStockObject
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetCurrentPositionEx
GetBrushOrgEx
GetBitmapBits
GdiFlush
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
BitBlt
oleaut32
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
SysFreeString
SysReAllocStringLen
SysAllocStringLen
shell32
ShellExecuteA
Shell_NotifyIconA
user32
CreateWindowExA
mouse_event
keybd_event
WindowFromPoint
UpdateWindow
UnregisterClassA
TranslateMessage
ShowWindow
SetWindowLongA
SetTimer
SetForegroundWindow
SetCursorPos
SetClipboardData
SendMessageA
ReleaseDC
RegisterClipboardFormatA
RegisterClassA
PostQuitMessage
PostMessageA
PeekMessageA
OpenClipboard
MsgWaitForMultipleObjects
MessageBoxA
MapVirtualKeyA
LoadStringA
LoadIconA
LoadCursorA
KillTimer
IsIconic
IsClipboardFormatAvailable
IsCharAlphaNumericA
GetWindowThreadProcessId
GetWindowTextA
GetWindowLongA
GetWindowDC
GetSystemMetrics
GetSysColor
GetWindow
GetMessageA
GetIconInfo
GetDesktopWindow
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClassInfoA
FindWindowA
FillRect
ExitWindowsEx
EnumClipboardFormats
EmptyClipboard
DrawIconEx
DispatchMessageA
DestroyWindow
DestroyIcon
DefWindowProcA
CreateIcon
CopyIcon
CloseClipboard
AttachThreadInput
CharNextA
CharLowerBuffA
CharUpperBuffA
CharToOemA
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
winmm
waveInUnprepareHeader
waveInStart
waveInReset
waveInPrepareHeader
waveInOpen
waveInClose
waveInAddBuffer
wsock32
WSACleanup
WSAStartup
WSAAsyncSelect
socket
setsockopt
send
recv
inet_addr
htons
connect
closesocket
Sections
Size: 496KB - Virtual size: 496KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE