Static task
static1
Behavioral task
behavioral1
Sample
3a2b33f93dd04000ebe00fa82ff006f2_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3a2b33f93dd04000ebe00fa82ff006f2_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3a2b33f93dd04000ebe00fa82ff006f2_JaffaCakes118
-
Size
149KB
-
MD5
3a2b33f93dd04000ebe00fa82ff006f2
-
SHA1
ca85100d0017bc556acf1bbdca8f9da47173946f
-
SHA256
9a16768d232612f7425ee19c99416422928ff014fb82c531129cf7344d74ac55
-
SHA512
0cd7cde7c25961a21580d78fc0a82fe81b4e04062a415e51b4bce89af74befd5f78e6b3aed34825d1ad5aa59037efc8f21c880cbfdd6cb24f8781a53ecfa7878
-
SSDEEP
3072:Xl2trp6KGZQyBN78jD56gt4roJxdwC2KwBfs6z9U:1cEw14SdnXSR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a2b33f93dd04000ebe00fa82ff006f2_JaffaCakes118
Files
-
3a2b33f93dd04000ebe00fa82ff006f2_JaffaCakes118.dll windows:4 windows x86 arch:x86
6bb07a7d8e524f3c7d78331a7daf2f6a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpyA
lstrlenA
CreateFileA
GlobalHandle
CloseHandle
GlobalUnlock
GlobalReAlloc
GetPrivateProfileStringA
WriteFile
GlobalAlloc
FreeLibrary
GetProcAddress
LoadLibraryA
MoveFileA
DeleteFileA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
OutputDebugStringA
LCMapStringW
CopyFileW
LoadLibraryW
FindResourceW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
DeleteFileW
CreateFileW
ReadFile
LoadResource
SizeofResource
InterlockedDecrement
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
lstrcmpiA
RaiseException
GetModuleFileNameA
IsDBCSLeadByte
LocalAlloc
LocalFree
GetLocalTime
lstrcatW
lstrcpynW
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
DisableThreadLibraryCalls
GetStringTypeA
LCMapStringA
GetOEMCP
GetACP
lstrcatA
GlobalFree
SearchPathA
GlobalLock
VirtualProtect
LockResource
GetCommandLineA
GetCPInfo
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
HeapAlloc
HeapFree
RtlUnwind
GetVersion
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStringTypeW
user32
CharNextA
UnregisterClassA
wsprintfA
advapi32
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
ole32
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
rpcrt4
NdrDllGetClassObject
Sections
.text Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 48KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ