setup
Static task
static1
Behavioral task
behavioral1
Sample
3d900bf16720e48f30151f80431bbd01_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3d900bf16720e48f30151f80431bbd01_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3d900bf16720e48f30151f80431bbd01_JaffaCakes118
-
Size
424KB
-
MD5
3d900bf16720e48f30151f80431bbd01
-
SHA1
f20629c3249e5c78b1160b6535e6fda3d610fd7e
-
SHA256
62688d4d75b16b2fd135e1bcec4935334939b50f0ff6ac6840b47944fa299fa4
-
SHA512
eb968f46210977400207afe0b4ab0aa4775956f5c3dfaf2162462a74aafe3f0d3de5763614cbcd9a96ba4a12310516beaf9e306af632a33fb2d4f632526d1519
-
SSDEEP
6144:VQGNjVbzi1HRG2n9O8h8vbXWTkGszZKHAw5q8mKZhMspvy4YHfobajWdjuo/:VQGNjVbWDG2n9O8ciIKgwkPHgWydjT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d900bf16720e48f30151f80431bbd01_JaffaCakes118
Files
-
3d900bf16720e48f30151f80431bbd01_JaffaCakes118.dll windows:4 windows x86 arch:x86
e8f6e0f4be6ba627b95d9ba5e047b583
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrlenA
InterlockedDecrement
InterlockedIncrement
GetLastError
CreateDirectoryA
GetFileAttributesA
SetFileTime
MoveFileA
WriteFile
GetFileSize
GetTickCount
CreateFileA
GetLogicalDriveStringsA
GetLogicalDrives
EnterCriticalSection
LeaveCriticalSection
Sleep
LockResource
LoadResource
SizeofResource
FindResourceA
GetCurrentThreadId
GetCommandLineA
lstrlenW
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameA
WideCharToMultiByte
SetFileAttributesA
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
FindClose
FindFirstFileA
GetVolumeInformationA
GetEnvironmentVariableA
GetProcAddress
LoadLibraryA
lstrcmpA
FindNextFileA
lstrcatA
lstrcpyA
OpenMutexA
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
DeviceIoControl
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
ExitProcess
MoveFileExA
CopyFileA
DeleteFileA
GetWindowsDirectoryA
GetSystemDirectoryA
GetShortPathNameA
WinExec
CreateEventA
CreateProcessA
WaitForSingleObject
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
OpenFileMappingA
SetFilePointer
FreeLibrary
GetDiskFreeSpaceExA
user32
DefWindowProcA
LoadStringA
DestroyWindow
CharNextA
advapi32
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA
OpenSCManagerA
OpenServiceA
ChangeServiceConfigA
StartServiceA
QueryServiceStatus
CloseServiceHandle
RegNotifyChangeKeyValue
GetUserNameA
CreateProcessAsUserA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryInfoKeyA
OpenProcessToken
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitialize
oleaut32
VarUI4FromStr
msvcp71
?_Nomemory@std@@YAXXZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?clear@ios_base@std@@QAEXH_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
setupapi
SetupIterateCabinetA
msvcr71
strlen
_strnicmp
_stricmp
__CppXcptFilter
_adjust_fdiv
_initterm
_onexit
__dllonexit
__security_error_handler
strcpy
_snprintf
__CxxFrameHandler
memset
_except_handler3
free
??3@YAXPAX@Z
??_V@YAXPAX@Z
memcpy
_strupr
_splitpath
_unlink
_access
strcat
rename
_mbsstr
sprintf
fwrite
fopen
fclose
strncpy
strstr
rand
srand
strcmp
fread
malloc
_resetstkoflw
realloc
strrchr
strncmp
_callnewh
comctl32
InitCommonControlsEx
Exports
Exports
Sections
.text Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 352KB - Virtual size: 348KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ