Static task
static1
Behavioral task
behavioral1
Sample
2d792f2d4911aabb3578d3e57533088e_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2d792f2d4911aabb3578d3e57533088e_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2d792f2d4911aabb3578d3e57533088e_JaffaCakes118
-
Size
31KB
-
MD5
2d792f2d4911aabb3578d3e57533088e
-
SHA1
0e215ff42ae2c8a9d712e99ccfe92eaf5dade07e
-
SHA256
eaf339dfc90616aca4fef826cf597159088accf937d12666688e7a5e63dfab97
-
SHA512
6230bb8e53975072cb1ad1e0763f37d40519729b7393e8739a29dfba23eec3e87cc2611ff2513db955026c9fa8ca4a5384bd895e29d0bbd82fb97402b7289b4a
-
SSDEEP
768:ljPjVCgxy/2scoM+zoQuoCPVy11HEzeTrqMNjUjhXhhUvj:ljPdczoQuoC411EMNjUj3hUvj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d792f2d4911aabb3578d3e57533088e_JaffaCakes118
Files
-
2d792f2d4911aabb3578d3e57533088e_JaffaCakes118.dll windows:4 windows x86 arch:x86
7c8dd7e898ef9e251b65ab4c3d3eef34
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpyA
GetVersionExA
DeleteFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
Sleep
ExitThread
TerminateThread
WaitForMultipleObjects
lstrcatA
CreateMailslotA
GetModuleFileNameA
WaitForSingleObject
IsBadReadPtr
ReadFile
lstrlenA
GetSystemDirectoryA
CreateDirectoryA
GetTickCount
GetTempFileNameA
GetFileAttributesA
GetCurrentProcessId
GetLastError
CloseHandle
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
ReleaseMutex
CreateEventA
CreateMutexA
CreateThread
OpenProcess
lstrcmpA
ResetEvent
CompareStringA
GetConsoleCP
GetCurrentThreadId
CreateFileA
WriteFile
SetEndOfFile
SetFilePointer
SetEvent
user32
CharUpperA
wsprintfA
wininet
InternetOpenA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
InternetCloseHandle
InternetConnectA
InternetGetConnectedState
iphlpapi
GetAdaptersInfo
advapi32
RegCloseKey
OpenProcessToken
CreateProcessAsUserA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExA
RegCreateKeyExA
RegNotifyChangeKeyValue
CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
CryptEncrypt
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptDecrypt
RegSetValueExA
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ