Static task
static1
Behavioral task
behavioral1
Sample
33348fedf11122620a70a45d99f5a04d_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
33348fedf11122620a70a45d99f5a04d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
33348fedf11122620a70a45d99f5a04d_JaffaCakes118
-
Size
136KB
-
MD5
33348fedf11122620a70a45d99f5a04d
-
SHA1
599b9e2c1e2827497b45d00e3e2a5e58620b0d7d
-
SHA256
8646a039b24915e52975c8bb506a3b7f4fa9101195652927833cf05d1eb8d7ad
-
SHA512
ba0a95c9f63226a0d338aae0850167ee26156460111ca088359eafb416080c9ed6c0f4830adc68864f4866b3e61a49824a3cb67c45a9d6aba7f6e2a59d9fa8b6
-
SSDEEP
3072:uBOkOTAXQSao4mva811RssxxZl9hKFYPih:uHcAASahmS81j5hKf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 33348fedf11122620a70a45d99f5a04d_JaffaCakes118
Files
-
33348fedf11122620a70a45d99f5a04d_JaffaCakes118.dll windows:4 windows x86 arch:x86
e9c61481a816357e6209b49238c1b299
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLocaleInfoA
LocalAlloc
LocalFree
InterlockedExchange
InterlockedCompareExchange
Sleep
WaitForSingleObject
GetCurrentThreadId
lstrcatA
CloseHandle
lstrcpyA
TerminateThread
SetEvent
WaitForSingleObjectEx
lstrlenW
GetSystemInfo
FreeLibrary
GetProcAddress
LoadLibraryW
GetLocalTime
FlushViewOfFile
OutputDebugStringA
IsBadWritePtr
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
DeviceIoControl
CreateFileW
GetFileSize
VirtualProtect
FindFirstFileW
lstrlenA
MultiByteToWideChar
LoadLibraryExW
IsDebuggerPresent
DebugBreak
GetCurrentProcess
GetCurrentThread
GetWindowsDirectoryA
GetVersionExA
GetModuleFileNameW
GetModuleHandleW
GetCurrentProcessId
lstrcatW
FormatMessageW
GetThreadContext
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetStringTypeA
LCMapStringW
LCMapStringA
HeapSize
LoadLibraryA
HeapReAlloc
VirtualAlloc
GetCPInfo
FindClose
GetCommandLineA
GetOEMCP
GetACP
HeapAlloc
RtlUnwind
VirtualQuery
ExitProcess
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
UnhandledExceptionFilter
GetStringTypeW
user32
SetProcessWindowStation
GetProcessWindowStation
LoadStringW
wsprintfW
wvsprintfW
wsprintfA
DialogBoxParamW
advapi32
RegisterEventSourceW
ole32
CoTaskMemAlloc
CoTaskMemFree
Sections
.text Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ