Static task
static1
Behavioral task
behavioral1
Sample
439833c1109d8b1d190c94b4267fb9a7_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
439833c1109d8b1d190c94b4267fb9a7_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
439833c1109d8b1d190c94b4267fb9a7_JaffaCakes118
-
Size
104KB
-
MD5
439833c1109d8b1d190c94b4267fb9a7
-
SHA1
0d32cfbf244d28187bb95734c5c3b1a2ee29c0eb
-
SHA256
1154fdace980da6a417ae78c0733e980e907172ee69b5ae8636afb688fa083c5
-
SHA512
a2b92ad373d44b85f1cbe2a493fafb08495792b8f830422d0b86a61830e7c72cd0544b8fdfcac08fa82381b898b26a638c602b71ca4ba2e5a28c00cca105608d
-
SSDEEP
1536:z1PVdF4c414jdeGrnnBwTnJtTLsb/UlKMJPjyGwwoMwM29RIHihrph/kCuVV:zNW52wDJRozU/rmw5wB9KHE0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 439833c1109d8b1d190c94b4267fb9a7_JaffaCakes118
Files
-
439833c1109d8b1d190c94b4267fb9a7_JaffaCakes118.dll windows:4 windows x86 arch:x86
ee940f39ab66a6b7703d921f0c0f5dc5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
SetPropA
ReleaseDC
RegisterClassA
GetWindowLongA
GetPropA
GetDoubleClickTime
GetDlgItemTextA
GetDC
GetClientRect
GetCapture
FrameRect
ExitWindowsEx
EnumChildWindows
DrawEdge
CloseClipboard
netapi32
NetDfsManagerSendSiteInfo
NetLocalGroupSetInfo
NetReplExportDirEnum
NetShareDel
NetUserEnum
oleaut32
SysReAllocString
SysStringLen
SafeArrayDestroy
RevokeActiveObject
OleTranslateColor
OleLoadPicture
OleIconToCursor
GetErrorInfo
dbghelp
SymGetModuleBase
SymGetLineFromAddr64
SymEnumerateSymbolsW
FindDebugInfoFileEx
shlwapi
ColorHLSToRGB
PathAddExtensionA
PathFindFileNameW
PathIsUNCServerA
AssocQueryKeyA
ChrCmpIA
advapi32
CreateProcessAsUserW
ElfOpenEventLogA
LookupPrivilegeNameA
LsaClearAuditLog
RegUnLoadKeyW
SetFileSecurityA
SetPrivateObjectSecurity
SetSecurityDescriptorRMControl
SetServiceStatus
AddAuditAccessObjectAce
kernel32
WriteFileEx
SetUnhandledExceptionFilter
SetTapeParameters
SetEvent
HeapCreate
HeapAlloc
GetVolumeInformationA
GetVersionExW
GetVersionExA
GetStartupInfoA
GetModuleHandleA
GetCommandLineA
FoldStringA
FindVolumeMountPointClose
FindFirstVolumeW
CancelTimerQueueTimer
CloseHandle
EnumResourceNamesA
EnumSystemLanguageGroupsW
ExitProcess
AssignProcessToJobObject
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ