Static task
static1
Behavioral task
behavioral1
Sample
466e0f1012511123639c08c9299fb8aa_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
466e0f1012511123639c08c9299fb8aa_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
466e0f1012511123639c08c9299fb8aa_JaffaCakes118
-
Size
135KB
-
MD5
466e0f1012511123639c08c9299fb8aa
-
SHA1
951a8eac769d8b7d438d5fde8e1cf8c926da6eea
-
SHA256
f19f3af31c102bb600bdd5f71dad9d95846a981671db68f35daa9d24055e422a
-
SHA512
a25ebb266c4fc31658b601428602bfc1125ebd12cd55b6a3107e4681034a96d332b7338ac1def3069cfc886566d076a3ab760279fe3f99d08729301f67f78213
-
SSDEEP
3072:S+4bMXkhr/qsZ8TZMfvft5zh/y1XeuoSMqqDLy/1yd:SvbMXM8T+NpyXeDqqDLu1y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 466e0f1012511123639c08c9299fb8aa_JaffaCakes118
Files
-
466e0f1012511123639c08c9299fb8aa_JaffaCakes118.dll windows:4 windows x86 arch:x86
05e6b5e4a1d065f8176a05d1e4243f2e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetOverlappedResult
FormatMessageW
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
InterlockedCompareExchange
CancelIo
CreateFileA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
lstrcpynA
lstrlenA
lstrcmpiA
GetACP
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleA
GetProcAddress
CompareStringA
WaitForMultipleObjects
DeleteFileA
GetStringTypeA
LCMapStringW
LCMapStringA
LoadLibraryA
GetOEMCP
GetCPInfo
HeapReAlloc
VirtualAlloc
HeapAlloc
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileType
GetStdHandle
VirtualProtect
ReadFile
GetTempFileNameW
WriteFile
OpenProcess
CreateEventW
GetCommandLineW
GlobalFree
DuplicateHandle
GetFileSizeEx
GetModuleFileNameW
lstrcmpiW
GetModuleHandleW
lstrlenW
LocalFree
CreateFileW
CopyFileW
LocalAlloc
DisableThreadLibraryCalls
Sleep
CloseHandle
WaitForSingleObject
CreateThread
InterlockedExchange
GetCurrentThreadId
ExpandEnvironmentStringsW
GetLocalTime
CreateDirectoryW
CreateProcessW
GetExitCodeProcess
FindFirstFileW
FindNextFileW
SetFileAttributesW
DeleteFileW
FindClose
GetCurrentProcessId
LoadLibraryExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCommandLineA
CompareStringW
SetHandleCount
HeapFree
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
ExitProcess
GetVersion
RtlUnwind
GetStringTypeW
user32
GetParent
OpenWindowStationW
GetWindowTextA
GetWindowLongW
GetThreadDesktop
SendDlgItemMessageW
SetWindowLongW
CheckRadioButton
SetFocus
ShowWindow
SetWindowTextW
PostMessageW
GetDlgItem
SendMessageW
CharNextW
SetThreadDesktop
OpenDesktopW
SetProcessWindowStation
LoadStringW
advapi32
RegisterEventSourceW
RegSetValueExW
ReportEventW
CryptGetProvParam
CryptReleaseContext
FreeSid
OpenProcessToken
AllocateAndInitializeSid
CryptSetProvParam
IsValidSecurityDescriptor
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessDeniedAce
AddAccessAllowedAce
GetAce
EqualSid
GetAclInformation
GetSecurityDescriptorDacl
CryptDestroyKey
CryptGetUserKey
CryptExportKey
GetTokenInformation
DuplicateToken
ImpersonateLoggedOnUser
RevertToSelf
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
InitializeAcl
IsValidSid
SetSecurityInfo
ConvertStringSidToSidW
RegEnumKeyW
RegEnumValueW
GetLengthSid
RegCloseKey
DeregisterEventSource
RegQueryValueExW
gdi32
GetObjectW
CreateFontIndirectW
ole32
StringFromGUID2
CoTaskMemFree
rpcrt4
UuidCreate
RpcStringFreeA
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
RpcAsyncCancelCall
NdrAsyncClientCall
RpcStringBindingComposeW
UuidToStringA
Sections
.text Size: 97KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ