Static task
static1
Behavioral task
behavioral1
Sample
3ff8327b4795832ff3a6456b66556fb5_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3ff8327b4795832ff3a6456b66556fb5_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3ff8327b4795832ff3a6456b66556fb5_JaffaCakes118
-
Size
100KB
-
MD5
3ff8327b4795832ff3a6456b66556fb5
-
SHA1
db350f97ea66606c6f94d52a57ce0a45fd14198a
-
SHA256
42417026e1a365505697e8d49482b32bcda87e93fe7f276cd00111f0e34d54a8
-
SHA512
6d916334d4c0af9d408a2974eb09b8bbabc1f337f62d2331ecadeec6e7fc554fa0e544837cdbfbbb42b4aab462d6c89dcf92c87efe480694affad7c76440bdc2
-
SSDEEP
3072:ol7Vt2ChrKgCWf3ltf3HVsMBCxn5R8ZEXz:QUErssl1VLBCp5cE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ff8327b4795832ff3a6456b66556fb5_JaffaCakes118
Files
-
3ff8327b4795832ff3a6456b66556fb5_JaffaCakes118.dll windows:4 windows x86 arch:x86
dd6fc235a66e72f4ba38f205c3852735
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FormatMessageW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LocalAlloc
LocalFree
lstrlenW
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
InterlockedExchange
SetLastError
CompareFileTime
lstrcmpW
LeaveCriticalSection
CloseHandle
GetCurrentThread
EnterCriticalSection
LoadLibraryW
DeleteCriticalSection
InitializeCriticalSection
lstrcmpiW
InterlockedDecrement
Sleep
InterlockedCompareExchange
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryA
GetProcAddress
GetModuleFileNameA
GetSystemDirectoryA
GetLastError
FormatMessageA
GetModuleHandleA
FreeLibrary
VirtualProtect
MultiByteToWideChar
DeleteFileA
GetVersion
GetCommandLineA
WideCharToMultiByte
user32
EnableWindow
ShowWindow
SendMessageW
MessageBoxW
LoadStringW
DestroyWindow
UpdateWindow
CreateDialogParamW
EndDialog
GetWindowTextW
GetWindowTextLengthW
DialogBoxParamW
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegisterEventSourceW
ReportEventW
RegCreateKeyExW
RegConnectRegistryW
CryptAcquireContextW
CryptReleaseContext
GetTokenInformation
OpenThreadToken
RevertToSelf
CryptGetProvParam
CryptDestroyKey
RegEnumKeyExW
DeregisterEventSource
ole32
CoGetClassObject
CoTaskMemAlloc
rpcrt4
UuidFromStringW
msvcrt
_fsopen
swprintf
_wtol
wcscpy
wcscmp
_wcsicmp
wcschr
_wcslwr
wcscat
iswspace
wcsncmp
_ltow
wcslen
wcsncat
wcsncpy
_XcptFilter
localtime
time
_except_handler3
fgets
exit
fputs
_cexit
_ismbblead
_acmdln
_initterm
_amsg_exit
memset
getenv
strerror
fopen
_errno
fclose
malloc
free
_vsnprintf
_vsnwprintf
_adjust_fdiv
Sections
.text Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ