Static task
static1
Behavioral task
behavioral1
Sample
3ab53bb85abb19438f5ff0d0a777ae16_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3ab53bb85abb19438f5ff0d0a777ae16_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3ab53bb85abb19438f5ff0d0a777ae16_JaffaCakes118
-
Size
100KB
-
MD5
3ab53bb85abb19438f5ff0d0a777ae16
-
SHA1
1eeec7a97a6392fd3d470c1b37186db0c860f42a
-
SHA256
c42503ea6ac3a53c6dd4021d825e6f5742207b363f42367ff5224a94c47ff4e6
-
SHA512
936ad68be8f581d03c94035175c98b1806d0d9b8bf13329abe37fc532d1e41473f1c01a4425fec8dfe4bca37d8ccd3594ebbec57a90994c6dba6f3d8fd27460c
-
SSDEEP
3072:ol7Vt2ChrKgCWf3Dtf3HVsMBCxn5R8ZEXz:QUErssD1VLBCp5cE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ab53bb85abb19438f5ff0d0a777ae16_JaffaCakes118
Files
-
3ab53bb85abb19438f5ff0d0a777ae16_JaffaCakes118.dll windows:4 windows x86 arch:x86
dd6fc235a66e72f4ba38f205c3852735
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FormatMessageW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LocalAlloc
LocalFree
lstrlenW
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
InterlockedExchange
SetLastError
CompareFileTime
lstrcmpW
LeaveCriticalSection
CloseHandle
GetCurrentThread
EnterCriticalSection
LoadLibraryW
DeleteCriticalSection
InitializeCriticalSection
lstrcmpiW
InterlockedDecrement
Sleep
InterlockedCompareExchange
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryA
GetProcAddress
GetModuleFileNameA
GetSystemDirectoryA
GetLastError
FormatMessageA
GetModuleHandleA
FreeLibrary
VirtualProtect
MultiByteToWideChar
DeleteFileA
GetVersion
GetCommandLineA
WideCharToMultiByte
user32
EnableWindow
ShowWindow
SendMessageW
MessageBoxW
LoadStringW
DestroyWindow
UpdateWindow
CreateDialogParamW
EndDialog
GetWindowTextW
GetWindowTextLengthW
DialogBoxParamW
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegisterEventSourceW
ReportEventW
RegCreateKeyExW
RegConnectRegistryW
CryptAcquireContextW
CryptReleaseContext
GetTokenInformation
OpenThreadToken
RevertToSelf
CryptGetProvParam
CryptDestroyKey
RegEnumKeyExW
DeregisterEventSource
ole32
CoGetClassObject
CoTaskMemAlloc
rpcrt4
UuidFromStringW
msvcrt
_fsopen
swprintf
_wtol
wcscpy
wcscmp
_wcsicmp
wcschr
_wcslwr
wcscat
iswspace
wcsncmp
_ltow
wcslen
wcsncat
wcsncpy
_XcptFilter
localtime
time
_except_handler3
fgets
exit
fputs
_cexit
_ismbblead
_acmdln
_initterm
_amsg_exit
memset
getenv
strerror
fopen
_errno
fclose
malloc
free
_vsnprintf
_vsnwprintf
_adjust_fdiv
Sections
.text Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ