Static task
static1
Behavioral task
behavioral1
Sample
2cce71d0db3b83c0d3b0df753bd930d3_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2cce71d0db3b83c0d3b0df753bd930d3_JaffaCakes118.dll
Resource
win10v2004-20240708-en
General
-
Target
2cce71d0db3b83c0d3b0df753bd930d3_JaffaCakes118
-
Size
482KB
-
MD5
2cce71d0db3b83c0d3b0df753bd930d3
-
SHA1
657da1cac45a169fd732c94e207ea573351854d3
-
SHA256
ece5a1e9048440754544f37c3dbc0e7778ee395f2bc2c0ea08e39ac4a62da26d
-
SHA512
19ce86af8fa8c4b848628b219c4cca3f87802b6741d044727df53a221d72aefb0e27356d1d038780bec206069492246f4a33067c2db818a4065a7ee07ce4363b
-
SSDEEP
6144:jdHtCVeJ6DA8nvyWqkZiFs/rSFw4aLW7yot/Q7Z5LTJeDhe24nRCsOx:jdHtCVeJ6kDDF6tRLxotAZ1Je9yE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2cce71d0db3b83c0d3b0df753bd930d3_JaffaCakes118
Files
-
2cce71d0db3b83c0d3b0df753bd930d3_JaffaCakes118.dll windows:4 windows x86 arch:x86
4d00a358ea254425e57f33851389a5fc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
lstrlenW
GetVersion
lstrcmpiA
lstrcmpiW
lstrlenA
CompareStringA
CompareStringW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStringTypeExA
GetStringTypeExW
GetTempPathA
GetLastError
GetVolumeInformationA
IsBadStringPtrA
CloseHandle
WriteFile
CreateFileA
GetTickCount
Sleep
MoveFileA
DeleteFileA
ReadFile
GetFileSize
CopyFileA
CreateThread
CreateMutexA
RaiseException
WideCharToMultiByte
MultiByteToWideChar
SetEnvironmentVariableA
GetLocaleInfoW
SetEndOfFile
GetTimeZoneInformation
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetModuleFileNameA
InterlockedExchange
SetStdHandle
FlushFileBuffers
IsBadCodePtr
GetUserDefaultLCID
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetFilePointer
GetStartupInfoA
GetFileType
SetEvent
OpenEventA
lstrcpyA
lstrcpyW
OutputDebugStringA
OutputDebugStringW
lstrcpynW
GetCurrentProcessId
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
WaitForSingleObject
GetCurrentThreadId
GetModuleFileNameW
InterlockedIncrement
VirtualAlloc
UnmapViewOfFile
IsBadReadPtr
GetSystemInfo
MapViewOfFile
CreateFileMappingA
GetCurrentThread
OpenFileMappingA
InterlockedDecrement
IsBadWritePtr
HeapValidate
VirtualProtect
VirtualQuery
RtlUnwind
ExitProcess
DebugBreak
GetStdHandle
GetProcAddress
LoadLibraryA
GetSystemTimeAsFileTime
GetCommandLineA
LCMapStringA
LCMapStringW
GetOEMCP
GetCPInfo
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
SetLastError
FatalAppExitA
HeapCreate
VirtualFree
TerminateProcess
GetCurrentProcess
QueryPerformanceCounter
SetConsoleCtrlHandler
SetUnhandledExceptionFilter
SetHandleCount
user32
TranslateMessage
GetMessageA
GetMessageW
IsWindowUnicode
CharLowerA
CharLowerW
CharUpperA
PeekMessageA
wsprintfW
DispatchMessageW
UnregisterClassA
CharUpperW
DispatchMessageA
MsgWaitForMultipleObjects
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
SetThreadToken
RevertToSelf
OpenThreadToken
RegCreateKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
CoReleaseMarshalData
CoMarshalInterface
CreateStreamOnHGlobal
CoUnmarshalInterface
CoRevokeClassObject
CoRegisterClassObject
oleaut32
SysFreeString
SysAllocString
VariantClear
SysAllocStringLen
VariantInit
shlwapi
PathFileExistsA
wininet
InternetReadFile
InternetOpenUrlA
InternetSetOptionA
InternetOpenA
InternetCloseHandle
Sections
.text Size: 380KB - Virtual size: 379KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ