Static task
static1
Behavioral task
behavioral1
Sample
2fa69116d332490086dbd093a7c5d76b_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2fa69116d332490086dbd093a7c5d76b_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2fa69116d332490086dbd093a7c5d76b_JaffaCakes118
-
Size
241KB
-
MD5
2fa69116d332490086dbd093a7c5d76b
-
SHA1
7df09c32614bd92b03b2584ecfa8b1c9c90b898b
-
SHA256
6b2635e3f2bd05a8313d90c218bb5fe8832bffaa9cd26e72011c068e321a634e
-
SHA512
1a995947f6e64f62541acf0a0017753ec07815f2ab5338f0787761bd71a80d8581908ecad5b6a5bd2ad42f6d257cf134c72f13dc21af217ae5c05c783cdfaac7
-
SSDEEP
6144:5+A/kt6xRMwYxi8h0VByhu22gCMO3ITETMrDdzmvZ:M0IUuRxi8WDyxAluETMf4B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2fa69116d332490086dbd093a7c5d76b_JaffaCakes118
Files
-
2fa69116d332490086dbd093a7c5d76b_JaffaCakes118.dll windows:4 windows x86 arch:x86
ee481b265ae5a1e6aa8e8e37b821b939
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetStdHandle
CreateThread
TerminateProcess
HeapSize
GetACP
GetTimeZoneInformation
ExitThread
GetFileType
HeapReAlloc
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
RaiseException
HeapAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
ReadFile
SetFilePointer
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
HeapFree
GetCommandLineA
GetStartupInfoA
RtlUnwind
FileTimeToSystemTime
GetTickCount
FileTimeToLocalFileTime
SetErrorMode
GetFileAttributesA
GetFileTime
GetFileSize
GetFullPathNameA
FindClose
GetVolumeInformationA
FindFirstFileA
SetEndOfFile
FlushFileBuffers
UnlockFile
LockFile
HeapDestroy
WriteFile
GlobalGetAtomNameA
GlobalAddAtomA
GetVersion
FormatMessageA
LocalFree
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
InterlockedDecrement
InterlockedIncrement
lstrcmpA
GetVersionExA
GetCurrentThreadId
lstrcpyA
lstrcatA
CreateProcessA
WaitForSingleObject
GetPrivateProfileSectionA
ExitProcess
WritePrivateProfileStringA
GetModuleFileNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
IsBadReadPtr
GetCurrentProcess
DuplicateHandle
GetProfileStringA
GetThreadLocale
SizeofResource
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLastError
GlobalAlloc
GetCurrentThread
MulDiv
SetLastError
CreateEventA
SuspendThread
SetThreadPriority
ResumeThread
SetEvent
CloseHandle
GlobalFree
LoadLibraryA
FreeLibrary
FindResourceA
LoadResource
LockResource
lstrcmpiA
GlobalFindAtomA
GlobalDeleteAtom
GetModuleHandleA
GetProcAddress
GlobalLock
lstrcpynA
GlobalUnlock
IsBadCodePtr
HeapCreate
VirtualFree
VirtualAlloc
OutputDebugStringA
gdi32
DeleteObject
GetDeviceCaps
GetViewportExtEx
CreatePen
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetMapMode
DPtoLP
GetTextColor
GetBkColor
LPtoDP
CreateDIBitmap
CreateCompatibleDC
BitBlt
GetTextExtentPointA
IntersectClipRect
SetWindowExtEx
ScaleWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
SetViewportOrgEx
SetMapMode
OffsetViewportOrgEx
GetStockObject
SetBkMode
RestoreDC
SaveDC
SelectObject
DeleteDC
CreateBitmap
GetObjectA
PatBlt
SetTextColor
GetClipBox
SetBkColor
GetWindowExtEx
CreateSolidBrush
Rectangle
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
shell32
DragQueryFileA
DragFinish
comctl32
ord17
oledlg
ord8
ole32
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoTaskMemFree
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
StgOpenStorageOnILockBytes
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoTaskMemAlloc
olepro32
ord253
oleaut32
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantChangeType
SysAllocString
VariantCopy
VariantTimeToSystemTime
VariantClear
SysAllocStringLen
Sections
.text Size: 185KB - Virtual size: 440KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 472KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.shared Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mstp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mstp02 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ