Static task
static1
Behavioral task
behavioral1
Sample
43322e1e53041815d5c5b72cda4c58e8_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
43322e1e53041815d5c5b72cda4c58e8_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
43322e1e53041815d5c5b72cda4c58e8_JaffaCakes118
-
Size
109KB
-
MD5
43322e1e53041815d5c5b72cda4c58e8
-
SHA1
ea19b164a2857d3beff652c77e920a85780d1e6d
-
SHA256
89b5368923bc2746b293004bde0b25027efb9cfacdaab442039ab23cafc59a5f
-
SHA512
141693224e4047599ccd42e53bea3c82a4688809304091fa995e1638fc26121eca7ebb88ead092a3b9c4d8a4c0b0e1db0d839c35976e39b9fa1e3a4b4ffb78a2
-
SSDEEP
3072:tcR67mh6YVYFnaR2BOrDICnlMl9NlC3sse3OqdSct:S5rCSsqg9acR3V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 43322e1e53041815d5c5b72cda4c58e8_JaffaCakes118
Files
-
43322e1e53041815d5c5b72cda4c58e8_JaffaCakes118.dll windows:4 windows x86 arch:x86
52c51b5779e7b9a995c596c9feb73e4f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SystemTimeToFileTime
GetSystemTime
GetVersionExW
CloseHandle
InterlockedCompareExchange
InterlockedExchange
GetSystemDirectoryW
MoveFileW
GetTickCount
SetFileAttributesW
GetSystemTimeAsFileTime
CreateEventW
GetCurrentThreadId
QueryPerformanceCounter
FindFirstFileW
FindClose
RemoveDirectoryW
SleepEx
FindNextFileW
CreateDirectoryExW
GetFileAttributesW
WaitForMultipleObjects
GetComputerNameW
GetProcAddress
LoadLibraryW
FreeLibrary
MultiByteToWideChar
lstrlenW
lstrcpyW
LocalAlloc
LocalFree
Sleep
GetCommandLineA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
VirtualProtect
GetCurrentProcessId
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
HeapSize
LoadLibraryA
GetCPInfo
GetOEMCP
HeapAlloc
HeapFree
RtlUnwind
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
VirtualQuery
ExitProcess
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
GetACP
GetSystemInfo
advapi32
RegEnumKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteValueW
RegNotifyChangeKeyValue
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegQueryValueExW
RegSetValueExW
RegConnectRegistryW
LsaFreeMemory
LsaClose
LsaQueryInformationPolicy
LsaOpenPolicy
RegEnumValueW
RegQueryInfoKeyW
rpcrt4
RpcServerUnregisterIf
RpcBindingVectorFree
RpcEpUnregister
RpcStringFreeW
RpcBindingServerFromClient
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcBindingFree
Sections
.text Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ