Static task
static1
Behavioral task
behavioral1
Sample
30f11176abf47845cdd85dfe3e41f744_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
30f11176abf47845cdd85dfe3e41f744_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
30f11176abf47845cdd85dfe3e41f744_JaffaCakes118
-
Size
111KB
-
MD5
30f11176abf47845cdd85dfe3e41f744
-
SHA1
b5bca37c1512e9c3f549ce07c009bc5b8bedfbc2
-
SHA256
809ccfe69a476da60a71814ac12bdd400bc2b1039273c2241af8b1f2cfc5b99e
-
SHA512
a867ea4a12476005d1a95953ace677b704451e5f57baff2ef9264e716a03471616e94307b6a40895a9e88de7aa631e6acde11b726fded203972f8d3d99889c2d
-
SSDEEP
3072:kEohQNgl+BUqJ2r7e2VuF+IN5NgoHOTBZfXxi0DB:CKaYxJOVegouTBZvjD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30f11176abf47845cdd85dfe3e41f744_JaffaCakes118
Files
-
30f11176abf47845cdd85dfe3e41f744_JaffaCakes118.dll windows:4 windows x86 arch:x86
316c1da0085ac01d0d377ce6f4768dfa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
SetLastError
GetProcAddress
LocalFree
lstrcmpW
TerminateProcess
FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
GetCurrentProcess
GetLogicalDrives
FormatMessageW
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
InterlockedCompareExchange
InterlockedExchange
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DebugBreak
DeviceIoControl
DeleteFileA
VirtualProtect
CreateFileA
GetLocalTime
WideCharToMultiByte
IsDebuggerPresent
GetLastError
CloseHandle
HeapFree
GetProcessHeap
CreateFileW
HeapAlloc
lstrlenW
GetVersion
GetCommandLineA
GetTickCount
GetFileAttributesW
user32
CharUpperW
advapi32
GetFileSecurityA
AdjustTokenPrivileges
RegCloseKey
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegQueryValueExW
GetSecurityDescriptorOwner
EqualSid
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
rpcrt4
NdrDllGetClassObject
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
msvcrt
towlower
_amsg_exit
wcscpy
wcscat
memmove
wcslen
__CxxFrameHandler
_except_handler3
wcstoul
wcschr
_vsnwprintf
wcsncmp
_wcsicmp
_wcsupr
wcsstr
memcpy
memset
iswctype
towupper
_onexit
_lock
__dllonexit
_XcptFilter
_callnewh
_CxxThrowException
free
malloc
_initterm
_adjust_fdiv
bsearch
wcscmp
Sections
.text Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ