Static task
static1
Behavioral task
behavioral1
Sample
356b11d75d30636757569e0f939803ab_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
356b11d75d30636757569e0f939803ab_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
356b11d75d30636757569e0f939803ab_JaffaCakes118
-
Size
32KB
-
MD5
356b11d75d30636757569e0f939803ab
-
SHA1
89aaaee7cae0d29e75dcd4aea9b0ddd61c08fd74
-
SHA256
1b21bceb807641aca387e263cd8eec8e2ec6ade4f205d8511d5babbea0c65d4c
-
SHA512
e3214bfbbe8364402cf2f459e9e88d31b24f0ee8a0d6395380bee425042c56abc80b840d55aab573a0dff9e5bdb10f4c0224c85a06224be7c249ffd24f4a40e2
-
SSDEEP
768:X64kPa/HT/OClEVthYgX3wE9drA/o92y:pkPa/HT/OC4UagCdgooy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 356b11d75d30636757569e0f939803ab_JaffaCakes118
Files
-
356b11d75d30636757569e0f939803ab_JaffaCakes118.dll windows:4 windows x86 arch:x86
b56c2dd9f92c80f999a315f76361c56e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
CloseHandle
GetPrivateProfileStringA
FreeLibrary
WritePrivateProfileStringA
GetProcAddress
GetSystemDirectoryA
CreateThread
TerminateThread
GetCommandLineA
GetVersion
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
RtlUnwind
user32
TranslateMessage
DispatchMessageA
FindWindowA
KillTimer
GetWindowThreadProcessId
SetTimer
GetMessageA
advapi32
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
wininet
InternetOpenA
InternetOpenUrlA
Sections
.text Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ