Static task
static1
Behavioral task
behavioral1
Sample
3dea04d498d1d94209cad954cf249a60_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3dea04d498d1d94209cad954cf249a60_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
3dea04d498d1d94209cad954cf249a60_JaffaCakes118
-
Size
160KB
-
MD5
3dea04d498d1d94209cad954cf249a60
-
SHA1
214b1204ff4dc70181beadb1b51294d24986ec56
-
SHA256
14349b8f4dba4008b63472bdabe1db7863635906863a1f7430a1afc6e294b8e5
-
SHA512
e66b66c48176e0c8e3d6c04b13e216ad5f6d22726bd5e15673f5767566116ef06c598b4541006b1f968e342de77f548cf4187c9bc436ac044bd80d42f7bf2726
-
SSDEEP
3072:uZsIdZ5z13c3tUsJ9SAG5Xt4NKf8QI+awksxhws25B37jssY0sxU:umIdZ5xMjHG5Xt4NKf8QI+awFZ27vzYj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3dea04d498d1d94209cad954cf249a60_JaffaCakes118
Files
-
3dea04d498d1d94209cad954cf249a60_JaffaCakes118.dll windows:4 windows x86 arch:x86
df0a05d9238c99e1eb063eff2dc1a851
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryW
GetProcAddress
GlobalLock
SetErrorMode
GetCurrentThreadId
CreateEventW
GlobalAddAtomA
_lclose
_lwrite
_llseek
_lopen
lstrcpyA
GetProfileIntA
GetProfileStringA
FatalAppExitA
FatalExit
GetLocalTime
_lcreat
lstrcmpiA
GlobalSize
GetDriveTypeW
IsBadReadPtr
GetEnvironmentStrings
GetVersion
ExitProcess
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
GetCPInfo
VirtualAlloc
GetModuleFileNameA
GetACP
GetOEMCP
GetStdHandle
GetFileType
GetStartupInfoA
WriteFile
InterlockedExchange
InterlockedCompareExchange
Sleep
LocalFree
GetCurrentProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleW
GlobalReAlloc
CreateThread
WaitForSingleObject
CloseHandle
ResetEvent
GetCurrentProcessId
InterlockedDecrement
LocalAlloc
GlobalFree
SetEvent
lstrlenW
MulDiv
GlobalAlloc
GlobalHandle
GlobalUnlock
lstrlenA
InterlockedIncrement
GetCommandLineA
VirtualFree
VirtualProtect
user32
GetClientRect
SetRect
UnionRect
PostThreadMessageA
wvsprintfA
PostMessageA
GetWindowThreadProcessId
LoadCursorW
SetCursor
EqualRect
OffsetRect
SetRectEmpty
IsWindowVisible
GetActiveWindow
SetWindowPos
GetWindowLongW
SetActiveWindow
SendMessageW
IsWindow
PostMessageW
GetDC
ReleaseDC
GetAsyncKeyState
IntersectRect
MsgWaitForMultipleObjects
PeekMessageW
LoadStringW
FillRect
DrawTextW
FrameRect
InvalidateRect
IsRectEmpty
GetSystemMetrics
wsprintfA
CallNextHookEx
DefWindowProcW
DestroyWindow
PostQuitMessage
BeginPaint
EndPaint
GetWindowTextW
SetWindowLongW
DispatchMessageW
TranslateMessage
GetMessageW
ClientToScreen
SetForegroundWindow
EnableMenuItem
CheckMenuItem
AppendMenuW
DeleteMenu
GetSystemMenu
ShowWindow
advapi32
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegOpenKeyA
RegQueryValueExA
RegCreateKeyW
RegOpenKeyW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegSetValueA
gdi32
GetClipBox
IntersectClipRect
GdiFlush
SaveDC
CreateHatchBrush
SetBkMode
GetStockObject
RestoreDC
ExcludeClipRect
GetDCOrgEx
DeleteObject
ole32
StringFromGUID2
CoTaskMemFree
CoInitialize
CoFreeUnusedLibraries
CoUninitialize
CoCreateInstance
msvcrt
memcpy
_except_handler3
ldexp
memmove
frexp
log10
pow
cos
_adjust_fdiv
_amsg_exit
_initterm
free
_XcptFilter
_vsnwprintf
wcschr
memset
malloc
Sections
.text Size: 96KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ