do_work
Static task
static1
Behavioral task
behavioral1
Sample
3495a83fcf3eff97daa7d297283a81b3_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3495a83fcf3eff97daa7d297283a81b3_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3495a83fcf3eff97daa7d297283a81b3_JaffaCakes118
-
Size
664KB
-
MD5
3495a83fcf3eff97daa7d297283a81b3
-
SHA1
d0feb325c6b76f74c73a8ec22a1a0540cbdb734c
-
SHA256
8bb65edd4e3485dd5601dce148e35b2e0e3af941f1e4c30fa81acc885247327b
-
SHA512
e0885711ec8fc120fbe7c08cb7b2937af5954f366bd31c2128b1386c88620688b64008b144bf4cd93b6c27049420307b1708bc56aeb8237f38936630f47f2774
-
SSDEEP
12288:woTVYRsEslC7SDUCnM0/wFPCRR85WUVtTZLxN+bYeLu:RTVYRsEbooFqR6WYNxxNZeLu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3495a83fcf3eff97daa7d297283a81b3_JaffaCakes118
Files
-
3495a83fcf3eff97daa7d297283a81b3_JaffaCakes118.dll windows:4 windows x86 arch:x86
cec77225619dc77d2d1ed9fd509feb48
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
wininet
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
imagehlp
ImageLoad
ImageUnload
kernel32
LockResource
LoadResource
FindResourceA
FindResourceExA
GetLastError
FlushFileBuffers
GetTempFileNameA
GetTempPathA
DeleteFileA
WideCharToMultiByte
WriteFile
SetFileAttributesA
GetFileAttributesA
FreeResource
GetVolumeInformationA
CreateEventA
WaitForSingleObject
LoadLibraryA
CreateThread
MultiByteToWideChar
RaiseException
InitializeCriticalSection
DeleteCriticalSection
lstrlenW
lstrlenA
GetTickCount
ReleaseMutex
GetFileSize
LocalFree
GetDriveTypeA
GetLogicalDriveStringsA
CreateMutexA
TerminateProcess
GetShortPathNameA
MoveFileExA
GetWindowsDirectoryA
GetPrivateProfileSectionA
SizeofResource
EnterCriticalSection
LeaveCriticalSection
OpenProcess
GetProcAddress
GetModuleHandleA
GetFileAttributesExA
InterlockedIncrement
ResetEvent
InterlockedDecrement
MapViewOfFileEx
CreateFileMappingA
UnmapViewOfFile
FindFirstFileA
FindNextFileA
FindClose
Module32Next
Module32First
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
GetCurrentThread
GetLongPathNameA
lstrcatW
lstrcpyW
lstrcmpW
CreateFileW
GetFileAttributesW
CreateDirectoryA
IsBadCodePtr
IsBadReadPtr
LCMapStringW
LCMapStringA
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetModuleFileNameA
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
CreateFileA
SetFilePointer
ReadFile
CloseHandle
DisableThreadLibraryCalls
SetEvent
SetStdHandle
SetEndOfFile
WritePrivateProfileSectionA
GetStdHandle
SetHandleCount
IsBadWritePtr
VirtualFree
HeapCreate
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
GetCPInfo
GetOEMCP
ExitThread
GetCommandLineA
GetCurrentThreadId
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
RtlUnwind
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
ExitProcess
user32
MsgWaitForMultipleObjects
PeekMessageA
IsWindowUnicode
GetMessageA
TranslateMessage
DispatchMessageW
DispatchMessageA
GetMessageW
advapi32
RegFlushKey
CryptCreateHash
CryptGetHashParam
CryptHashData
CryptAcquireContextA
CryptReleaseContext
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenThreadToken
OpenProcessToken
RegEnumValueA
RegEnumKeyA
RegSetValueA
RegQueryValueExA
RegCreateKeyExA
CryptDestroyHash
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
shell32
SHGetFolderPathW
SHGetFolderPathA
ole32
StgOpenStorage
StgCreateDocfile
shlwapi
PathMatchSpecA
SHDeleteKeyA
SHDeleteValueA
PathRemoveFileSpecA
SHCreateStreamOnFileA
PathStripPathA
PathCombineA
PathAddBackslashA
PathAppendA
PathIsDirectoryA
PathFileExistsA
psapi
GetModuleFileNameExA
EnumProcessModules
EnumProcesses
userenv
UnloadUserProfile
Exports
Exports
Sections
.rdata Size: 48KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 256KB - Virtual size: 262KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 340KB - Virtual size: 338KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ