Static task
static1
Behavioral task
behavioral1
Sample
3f1db4985c2f7ca71353eb88dc172f0d_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3f1db4985c2f7ca71353eb88dc172f0d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3f1db4985c2f7ca71353eb88dc172f0d_JaffaCakes118
-
Size
68KB
-
MD5
3f1db4985c2f7ca71353eb88dc172f0d
-
SHA1
2f4a20412a53e32f80aa448cdb0298351835f50e
-
SHA256
7c4c5993535f163a5bd073deafa12817fbfa59d932839eb5d424496576d18ac6
-
SHA512
60fe8e62172860b47a770b5767bc2997b06af849a8e0c01cddbae5cbac5cb30cb2d1800a808f2bd8fcb153357103aa00f832ee63d4fa4dc6fc11048ef698d786
-
SSDEEP
1536:38aQ5QjCD/sntOeEbaGpYj5Uwj/JFXcCBz8HZIFuUY2Z:38aQ5QjCD/sVEYj5UwjzMKzPFrY2Z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f1db4985c2f7ca71353eb88dc172f0d_JaffaCakes118
Files
-
3f1db4985c2f7ca71353eb88dc172f0d_JaffaCakes118.dll windows:4 windows x86 arch:x86
0e719d2f04b075d5722be760b22ddaf9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetLastError
GetLastError
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CloseHandle
ResumeThread
ReadFile
CreateThread
CreateFileW
GetCurrentThread
OutputDebugStringA
FreeLibrary
IsDBCSLeadByte
GetModuleFileNameA
lstrcmpiA
lstrlenA
GetModuleHandleA
DeleteCriticalSection
WideCharToMultiByte
RaiseException
LocalFree
HeapAlloc
GetProcessHeap
HeapFree
lstrlenW
GetTickCount
InterlockedExchange
GetCurrentThreadId
GetCurrentProcess
ResetEvent
SetEvent
CreateEventW
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Sleep
QueryPerformanceCounter
InterlockedCompareExchange
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetVersion
GetCommandLineA
DisableThreadLibraryCalls
VirtualProtect
user32
PostThreadMessageW
PeekMessageW
CharNextA
GetQueueStatus
advapi32
IsValidSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
SetSecurityDescriptorDacl
FreeSid
SetEntriesInAclA
AllocateAndInitializeSid
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetSecurityDescriptorOwner
RegOpenKeyExA
RegCloseKey
RegCreateKeyW
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
CopySid
RegQueryValueExA
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
GetLengthSid
ole32
CoUninitialize
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoFreeUnusedLibraries
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
msvcrt
__dllonexit
_onexit
malloc
_CxxThrowException
_errno
_vsnwprintf
memset
memcpy
free
_initterm
_amsg_exit
_adjust_fdiv
_except_handler3
localtime
time
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ