Static task
static1
Behavioral task
behavioral1
Sample
432d7ce1f1a03f8201e8a99e0e2f7cf2_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
432d7ce1f1a03f8201e8a99e0e2f7cf2_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
432d7ce1f1a03f8201e8a99e0e2f7cf2_JaffaCakes118
-
Size
246KB
-
MD5
432d7ce1f1a03f8201e8a99e0e2f7cf2
-
SHA1
d75fa2a6354e2df3fd0e512450541cb338821f4b
-
SHA256
f4fccc998e99012c1f8c2f9ed79c4378f364b32122ab1ece29f4027a590dc61b
-
SHA512
9a9d7e4d9cd309ab5fb9d7e395d40b1b4eddb6bb4b8b52aa6357a609335ceddba1ddf7983d6fa34c39eb909188d847077c6723e3614ed8360a5369716890a10b
-
SSDEEP
6144:XsUY/T+/j/LI72v8U6QeeaQeenLQeesQeecDQeehQee/i08qV0J3LMssU:XsUY/CzLIlJ0i7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 432d7ce1f1a03f8201e8a99e0e2f7cf2_JaffaCakes118
Files
-
432d7ce1f1a03f8201e8a99e0e2f7cf2_JaffaCakes118.dll windows:5 windows x86 arch:x86
ed3a03376d85bf25e175b61a505d22d2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateThread
GetModuleHandleA
Sleep
ExitProcess
VirtualAlloc
VirtualProtect
IsProcessorFeaturePresent
GetSystemInfo
OutputDebugStringA
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryA
GetProcAddress
user32
ShowWindow
CreateWindowExA
SetRect
DestroyWindow
GetKeyState
GetAsyncKeyState
gdi32
GetCharacterPlacementW
SetBkMode
GetCharacterPlacementA
GetGlyphOutlineA
ExtTextOutW
MoveToEx
CreateFontIndirectW
CreateFontIndirectA
GetFontLanguageInfo
GetTextMetricsW
GetTextMetricsA
DeleteObject
ExtTextOutA
SetTextAlign
GetObjectA
SetTextColor
SelectObject
SetMapMode
CreateDIBSection
CreateCompatibleDC
GetObjectW
DeleteDC
SetBkColor
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
shell32
ShellExecuteA
msvcr90
iswdigit
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
vsprintf_s
??2@YAPAXI@Z
memset
memcpy
clock
??_U@YAPAXI@Z
sprintf
malloc
_time64
_localtime64
free
??3@YAXPAX@Z
_ftol
strncpy
iswpunct
iswalpha
iswspace
_CIacos
_finite
__CxxFrameHandler
d3d9
Direct3DCreate9
Sections
.text Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ