Static task
static1
Behavioral task
behavioral1
Sample
30883cbf0d11c77fbe39063f43fd5466_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
30883cbf0d11c77fbe39063f43fd5466_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
30883cbf0d11c77fbe39063f43fd5466_JaffaCakes118
-
Size
35KB
-
MD5
30883cbf0d11c77fbe39063f43fd5466
-
SHA1
281f86b67104590949096aaaf04b7c1d189ddbb3
-
SHA256
d1cccb6ec955dd0290079da7491fc47b6155875837fb8d5f5ef2cfe00242d74f
-
SHA512
7c647fd66ded1c7fc7dba596df87eb4b00e1d59e0de146e66405130316097715773497bb5a858be6916b969ecef5edbda26474cab00049090820e753d93ecdd2
-
SSDEEP
384:8mjmhL5kKw2DxuV7jkdcgRNeh/NRNzj0NzUYYUggreTLZRpNej7koRkjLRqfG:RyktfkOgRyRj0VDgaeTKjQoaj8f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30883cbf0d11c77fbe39063f43fd5466_JaffaCakes118
Files
-
30883cbf0d11c77fbe39063f43fd5466_JaffaCakes118.dll windows:4 windows x86 arch:x86
e8ffa59cb97c8cb9004970a4ed8765b9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
UnmapViewOfFile
MapViewOfFile
GetVersionExA
FreeLibrary
VirtualQuery
GetCurrentProcessId
GetProcAddress
LoadLibraryA
FileTimeToSystemTime
GetFileTime
CreateFileA
SetFileTime
SystemTimeToFileTime
VirtualFree
CreateFileMappingA
MultiByteToWideChar
GetFullPathNameA
ReadFile
VirtualAlloc
LocalLock
WinExec
WriteFile
GetTempFileNameA
GetTempPathA
Sleep
SetFilePointer
GetDriveTypeA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetSystemTime
CreateThread
GetTickCount
CreateMutexA
ReleaseMutex
WaitForSingleObject
OpenMutexA
GetCommandLineA
LocalUnlock
GetLastError
TerminateProcess
GetModuleFileNameA
GetSystemDirectoryA
MoveFileA
CopyFileA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
GetModuleHandleA
LocalAlloc
LocalFree
GetCurrentProcess
CloseHandle
FindFirstFileA
FindNextFileA
GetFileSize
FindClose
user32
wsprintfA
advapi32
DuplicateTokenEx
CreateProcessAsUserA
GetSecurityInfo
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
AllocateAndInitializeSid
GetTokenInformation
GetLengthSid
InitializeAcl
AddAccessDeniedAce
SetSecurityInfo
FreeSid
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
LsaNtStatusToWinError
ImpersonateLoggedOnUser
ntdll
NtVdmControl
ZwTerminateThread
RtlInitUnicodeString
sprintf
memmove
ZwOpenSection
ZwClose
ZwQuerySystemInformation
wcscpy
mpr
WNetCloseEnum
WNetOpenEnumA
WNetEnumResourceA
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ