Static task
static1
Behavioral task
behavioral1
Sample
3f20b9cae93453aa914f56a87e979518_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3f20b9cae93453aa914f56a87e979518_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3f20b9cae93453aa914f56a87e979518_JaffaCakes118
-
Size
15KB
-
MD5
3f20b9cae93453aa914f56a87e979518
-
SHA1
51e041b04faf85ab0da050965068b1ac72c12acc
-
SHA256
bae860977ca648dd73761b840e2e9fbc3d2511ae87b3277ebd72596b68eec2ef
-
SHA512
ead1db8901690b1cbc4d38891f64525d95955c70a50204442240d22403c5d4b35ffc87fa8b74ee74b30a82c688575b4801b8e57954de60815dff1b120c7fd936
-
SSDEEP
192:BDtDQEx37uQUhlq1ElCAc5nxe5TzQ3g53/mOmEH2mOBr/HsIiO6QJ:BB0EtNUPdw5xeppV/mvEH2m8r/HsIiO3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f20b9cae93453aa914f56a87e979518_JaffaCakes118
Files
-
3f20b9cae93453aa914f56a87e979518_JaffaCakes118.dll windows:4 windows x86 arch:x86
42296bc2298345e58ac563735443f0f1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
IsBadReadPtr
GetTickCount
CloseHandle
GetCurrentProcess
DeleteFileW
GetTempPathW
QueryPerformanceCounter
QueryPerformanceFrequency
SetPriorityClass
GetPriorityClass
GetVolumeInformationW
GetSystemDirectoryW
GetComputerNameW
GetVersionExW
GlobalMemoryStatus
lstrlenW
FindNextFileW
FindClose
lstrcpyW
GetLastError
SetCurrentDirectoryW
ReadFile
GetFileSize
SetFilePointer
CreateFileW
SetEndOfFile
WriteFile
Process32NextW
OpenProcess
lstrcmpiW
Process32FirstW
CreateToolhelp32Snapshot
CreateProcessW
Sleep
lstrlenA
SetErrorMode
CreateThread
GetModuleFileNameW
LoadLibraryW
SetLastError
GetProcAddress
VirtualProtect
RtlMoveMemory
LeaveCriticalSection
EnterCriticalSection
GetCurrentThread
GetThreadPriority
SetThreadPriority
DeleteCriticalSection
InitializeCriticalSection
RtlZeroMemory
GlobalFree
FindFirstFileW
GlobalAlloc
user32
wsprintfW
advapi32
CreateProcessAsUserW
DuplicateTokenEx
RegCreateKeyW
RegSaveKeyW
RegRestoreKeyW
RegSetValueExW
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetUserNameW
shell32
ord64
dnsapi
DnsFlushResolverCache
ws2_32
closesocket
setsockopt
htons
socket
gethostbyname
WSAStartup
send
recv
WSAGetLastError
connect
shlwapi
PathFindFileNameW
SHDeleteKeyW
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 656B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 802B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ