Static task
static1
Behavioral task
behavioral1
Sample
2f9bee0309b0e221752bd3349f3f6378_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2f9bee0309b0e221752bd3349f3f6378_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2f9bee0309b0e221752bd3349f3f6378_JaffaCakes118
-
Size
166KB
-
MD5
2f9bee0309b0e221752bd3349f3f6378
-
SHA1
0559ac7b03e188a95f032193144e565385ef849f
-
SHA256
55d273db93ac220ad24d1509daaaaa75391a0d70b9b5723347ee737f07bc8773
-
SHA512
b627a350a8abff4024afe45e8b5809a336d0a7ba8d2d9e4d3f2b2e0d635cac5f772205cc1e3fe5d679d2185d77264781e15a2767ee448cb31b6ecc0dda0e8123
-
SSDEEP
3072:HodSoyrVSdGEpeUN8R8kq3oy5lypFgKvhGAt+HcU2FG1CRrtna5Kxen:IrUUdGW5Lyp9x47cPnNq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f9bee0309b0e221752bd3349f3f6378_JaffaCakes118
Files
-
2f9bee0309b0e221752bd3349f3f6378_JaffaCakes118.dll windows:4 windows x86 arch:x86
80c212689c3f38876221d437922f3dae
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
IsDBCSLeadByte
LoadLibraryA
InterlockedIncrement
InterlockedExchange
InterlockedExchangeAdd
GetModuleFileNameA
GetProcAddress
GetVersionExA
MulDiv
GetSystemTimeAsFileTime
GetLocalTime
VirtualAlloc
VirtualProtect
Sleep
QueryPerformanceFrequency
IsDebuggerPresent
GetComputerNameA
GetCurrentThreadId
IsBadCodePtr
GetUserDefaultLCID
user32
GetCursor
GetWindowContextHelpId
GetWindowRect
GetWindowTextLengthA
IsCharLowerA
IsCharAlphaNumericA
GetWindowDC
CopyIcon
GetAncestor
GetTitleBarInfo
GetWindowInfo
GetTopWindow
IsZoomed
IsIconic
GetGUIThreadInfo
GetParent
InSendMessage
IsChild
GetMenuContextHelpId
advapi32
AreAnyAccessesGranted
RevertToSelf
msvcrt
_adjust_fdiv
malloc
_initterm
free
_swab
srand
_set_error_mode
ldiv
__mb_cur_max
_CIacos
_CIsinh
floor
ceil
time
localeconv
ldexp
_pctype
_isctype
_errno
gdi32
GetBitmapDimensionEx
GdiGetBatchLimit
GetStretchBltMode
ole32
CoFileTimeNow
CoDosDateTimeToFileTime
CoRevertToSelf
shell32
ord66
DuplicateIcon
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ