Static task
static1
Behavioral task
behavioral1
Sample
4be83e250038d9b6eebd138ec47b756c_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4be83e250038d9b6eebd138ec47b756c_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4be83e250038d9b6eebd138ec47b756c_JaffaCakes118
-
Size
124KB
-
MD5
4be83e250038d9b6eebd138ec47b756c
-
SHA1
0a6082ec1c06c69d12558061cca7614a4ed5c69c
-
SHA256
dc324eefb6a941165853dfa178d48f2d295a658ae48ac42d00944f5bdccc33f7
-
SHA512
d5362bb5654d0b88c772bf047ba3edee6434790ad553ddc238636fb9c272838438d782922c9b77c7af03e33bfd53a299285d4f4347f26db3dcdfc88e118215b7
-
SSDEEP
3072:yNNU2/Lx5PuYpC+VdfC4wBBYzKWzgo6muAGDiX:mHVMBFnT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4be83e250038d9b6eebd138ec47b756c_JaffaCakes118
Files
-
4be83e250038d9b6eebd138ec47b756c_JaffaCakes118.dll windows:4 windows x86 arch:x86
a11c2f82d1686c17ab4288d85ee02306
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DisableThreadLibraryCalls
GetCurrentProcess
TerminateProcess
DebugBreak
OutputDebugStringA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GlobalLock
GlobalAlloc
GetFullPathNameW
FindNextFileW
FindClose
lstrlenW
FormatMessageW
LocalFree
WideCharToMultiByte
GetProcessHeap
WriteFile
WriteConsoleW
GetModuleHandleW
GetThreadLocale
CompareStringW
GetFileAttributesW
CreateDirectoryW
GetTickCount
CloseHandle
SetEvent
IsBadReadPtr
RaiseException
GetProcAddress
FlushFileBuffers
SetFilePointer
GetVersionExW
GetFileSize
DeleteFileW
UnmapViewOfFile
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetOEMCP
GetStringTypeW
GetACP
GetCPInfo
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ExitProcess
HeapReAlloc
IsBadWritePtr
QueryPerformanceCounter
QueryPerformanceFrequency
GetThreadContext
GetCurrentThread
GetSystemDirectoryA
GetWindowsDirectoryA
InterlockedExchange
VirtualQueryEx
Sleep
InterlockedCompareExchange
GetModuleFileNameA
VirtualProtect
CreateFileW
GetCommandLineA
HeapAlloc
HeapFree
RtlUnwind
GetVersion
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
user32
LoadStringW
GetDC
BeginPaint
GetWindowLongW
LoadBitmapW
GetWindowRect
EndPaint
ReleaseDC
MessageBoxA
DialogBoxParamA
SetWindowLongA
MessageBeep
EnableWindow
SendMessageA
SetWindowTextA
EndDialog
GetDlgItem
GetWindowLongA
advapi32
GetKernelObjectSecurity
OpenProcessToken
OpenThreadToken
AdjustTokenPrivileges
SetThreadToken
DuplicateTokenEx
RegQueryValueExA
gdi32
GetObjectW
CreateCompatibleDC
SelectObject
BitBlt
GetSystemPaletteEntries
DeleteDC
Sections
.text Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ