Static task
static1
Behavioral task
behavioral1
Sample
2e2e478f874326203eb42f5a0c9a10f8_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2e2e478f874326203eb42f5a0c9a10f8_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2e2e478f874326203eb42f5a0c9a10f8_JaffaCakes118
-
Size
57KB
-
MD5
2e2e478f874326203eb42f5a0c9a10f8
-
SHA1
a48636e6cf5e34d0d8f7465056edd0d8dcd06d63
-
SHA256
1972cbdfe2c3022f7768704173dac0a35a3880e8a62de92cf843819c1969a804
-
SHA512
399de9e24198d32d6dcfe49288255b90450f68071d9774d0f57716e08b2e7df6e4e291593943a67dbc4056f81bd0399bd8aa4b0f7223a782a323d583ac81e819
-
SSDEEP
1536:zBO+F5OU+QWpwYI9rKl378pW7rmy00+T:JJYpwYkrK4Q76y7+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2e2e478f874326203eb42f5a0c9a10f8_JaffaCakes118
Files
-
2e2e478f874326203eb42f5a0c9a10f8_JaffaCakes118.dll windows:4 windows x86 arch:x86
6fe15754997fe4423a6fd4b69635049d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ndis.sys
NdisAllocatePacket
NdisGetFirstBufferFromPacket
NdisMSleep
NdisFreePacketPool
NdisFreeBuffer
NdisUnchainBufferAtFront
NdisReleaseSpinLock
NdisOpenAdapter
NDIS_BUFFER_TO_SPAN_PAGES
NdisAcquireSpinLock
NdisDprAcquireSpinLock
NdisDprFreePacket
NdisAllocateSpinLock
NdisFreeBufferPool
NdisQueryBufferOffset
NdisFreeSpinLock
NdisDprAllocatePacket
NdisAllocateBuffer
NdisAllocatePacketPoolEx
NdisQueryBuffer
NdisCloseAdapter
NdisFreePacket
NdisAllocateBufferPool
NdisDprReleaseSpinLock
ntoskrnl.exe
RtlCompareMemory
ZwReadFile
RtlInitUnicodeString
ZwSetValueKey
ZwSetInformationFile
ZwCreateFile
ZwQueryValueKey
ZwClose
RtlCompareUnicodeString
ZwQueryInformationFile
ZwWriteFile
ZwOpenKey
sprintf
strlen
RtlAppendUnicodeToString
memset
RtlAppendUnicodeStringToString
ZwDeleteKey
KeQuerySystemTime
_stricmp
IoDeleteSymbolicLink
memmove
strncmp
RtlAnsiStringToUnicodeString
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
strstr
IoDeleteDevice
KeSetEvent
swprintf
strchr
MmGetSystemRoutineAddress
KeInitializeEvent
RtlInitAnsiString
atoi
RtlFreeUnicodeString
PsCreateSystemThread
PsTerminateSystemThread
InterlockedExchange
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
KeTickCount
IoCreateSymbolicLink
ObfDereferenceObject
RtlUnicodeStringToInteger
IoCreateDevice
atol
ExAllocatePoolWithTag
memcpy
KeInitializeMutex
KeSetPriorityThread
KeReleaseMutex
KeGetCurrentThread
KefAcquireSpinLockAtDpcLevel
KeInitializeSemaphore
KeReleaseSemaphore
KeReadStateSemaphore
KefReleaseSpinLockFromDpcLevel
KeInitializeSpinLock
ZwEnumerateKey
RtlUnwind
ZwDeleteFile
KeServiceDescriptorTable
ZwOpenFile
ZwQueryVolumeInformationFile
ZwQueryInformationProcess
ZwCreateEvent
NtBuildNumber
ZwQuerySystemInformation
ZwQueryDirectoryFile
hal
KfReleaseSpinLock
KfAcquireSpinLock
Sections
.text Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1024B - Virtual size: 711B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ