wiynnb
Static task
static1
Behavioral task
behavioral1
Sample
39427a453457fe7ece7ef126cc972c53_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
39427a453457fe7ece7ef126cc972c53_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
39427a453457fe7ece7ef126cc972c53_JaffaCakes118
-
Size
407KB
-
MD5
39427a453457fe7ece7ef126cc972c53
-
SHA1
edec871af8e0e8d872fff653e486229319a001bc
-
SHA256
2cb498e3899a3f7753f8780d1b8f2bf362671a61b9d37244df879c62bc44916c
-
SHA512
501a954b149af6af41159707fb73390e0bb93037e7135a7449eede1ffc6e65142a9cd99f4ab90a138686f61de1d45bc95c23564f077b193262160a9b84877980
-
SSDEEP
6144:jbP4mk4J2G+X7h1QVZiVfn7klXS4OGN9ijI2oI:j1k4QGKeY4S4X9GhT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 39427a453457fe7ece7ef126cc972c53_JaffaCakes118
Files
-
39427a453457fe7ece7ef126cc972c53_JaffaCakes118.dll windows:4 windows x86 arch:x86
b714e698fb14d25b4d46d52f38d9a158
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExitProcess
CreateFileA
MoveFileWithProgressA
FillConsoleOutputCharacterA
ReadConsoleInputA
EnumCalendarInfoExA
HeapFree
GetProcessHeap
HeapAlloc
ExitThread
Beep
user32
LoadStringW
ExitWindowsEx
MessageBeep
GetSystemMetrics
BroadcastSystemMessageA
GetCursorPos
GetMessageTime
advapi32
RegDeleteValueW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextW
OpenProcessToken
GetTokenInformation
RegSetValueExW
AllocateAndInitializeSid
LookupAccountSidW
FreeSid
OpenThreadToken
SetThreadToken
RevertToSelf
RegQueryInfoKeyW
RegQueryValueExW
RegNotifyChangeKeyValue
RegOpenKeyExW
CloseServiceHandle
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
RegOpenKeyW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
CryptSetProvParam
CryptGetProvParam
CryptReleaseContext
RegConnectRegistryW
rpcrt4
RpcImpersonateClient
RpcServerInqDefaultPrincNameW
RpcServerRegisterAuthInfoW
RpcServerRegisterIfEx
RpcBindingToStringBindingW
RpcServerListen
RpcStringFreeW
I_RpcBindingIsClientLocal
RpcStringBindingParseW
RpcServerRegisterIf
NdrServerCall2
RpcRaiseException
I_RpcBindingInqLocalClientPID
RpcServerUseProtseqEpW
RpcRevertToSelf
Exports
Exports
Sections
.text Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 364KB - Virtual size: 363KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ