EnumTvValueRelease
Static task
static1
Behavioral task
behavioral1
Sample
2dfad1779165044c383a4c2111e4b840_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2dfad1779165044c383a4c2111e4b840_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2dfad1779165044c383a4c2111e4b840_JaffaCakes118
-
Size
216KB
-
MD5
2dfad1779165044c383a4c2111e4b840
-
SHA1
b3acd54c7a83067edc3d7f4118e03bbf5aee83e2
-
SHA256
c979e1a38d33e74458897ba24c7d7bac68f27ebb3bd0fb21efe6ff68bf71b60f
-
SHA512
255ab0bdc311758f479dac8c5514b63746a2db092ec8e5eb5167a56df6fbecad58512baf63c35bdf7ca4a1d67f1d82bf41f990a7d99fcc4c3318de0a0f9db7e2
-
SSDEEP
3072:sYhDLS7VR+6IK3Ov4Nseh6Yz/lthFwvoUrhFwCoPT9HHZLu+28Fbq9tM:hMVBIK3Ov4NIYNdwvjrhFpGTBHZL7xL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dfad1779165044c383a4c2111e4b840_JaffaCakes118
Files
-
2dfad1779165044c383a4c2111e4b840_JaffaCakes118.dll windows:4 windows x86 arch:x86
c7b92d8cb8a5a219a7c26899341b70d9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CompareStringW
ExitProcess
ExpandEnvironmentStringsA
GetCommandLineA
GetCurrentProcess
GetCurrentProcessId
GetFileAttributesA
GetLastError
GetModuleHandleA
GetNumberFormatA
GetProcessHeap
GetTickCount
GetVersionExA
GlobalAlloc
GlobalUnlock
HeapAlloc
HeapCreate
HeapReAlloc
HeapSize
InterlockedExchange
IsValidCodePage
MultiByteToWideChar
ReadProcessMemory
ResumeThread
RtlUnwind
SetConsoleCtrlHandler
SetLastError
SetUnhandledExceptionFilter
VirtualAlloc
VirtualQueryEx
WriteConsoleA
lstrcatA
lstrlenW
user32
TrackPopupMenu
SetUserObjectSecurity
SetScrollInfo
RemoveMenu
RegisterClassExA
PeekMessageA
KillTimer
IsDialogMessageA
GetWindowPlacement
GetWindow
GetKeyState
EnumChildWindows
EndDeferWindowPos
CreateMenu
BeginDeferWindowPos
GetClientRect
advapi32
RegSetValueA
RegSetKeySecurity
RegDeleteKeyW
ObjectDeleteAuditAlarmA
LogonUserW
GetTokenInformation
CryptDuplicateHash
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertSDToStringSDRootDomainA
SetTraceCallback
IsTokenRestricted
ddraw
DSoundHelp
DDInternalUnlock
DDInternalLock
DirectDrawCreateEx
DirectDrawEnumerateA
DirectDrawEnumerateExA
DirectDrawEnumerateExW
DirectDrawEnumerateW
DirectDrawCreateClipper
ole32
CoCreateInstance
CoRevokeClassObject
CreateBindCtx
IsEqualGUID
Exports
Exports
Sections
.text Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 92KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ