Static task
static1
Behavioral task
behavioral1
Sample
4819ffe03a92f466087131fc1e581f7c_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4819ffe03a92f466087131fc1e581f7c_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4819ffe03a92f466087131fc1e581f7c_JaffaCakes118
-
Size
120KB
-
MD5
4819ffe03a92f466087131fc1e581f7c
-
SHA1
884d18995816c1606978f80228426fea6ae76b24
-
SHA256
64314747b00adb55b07e6e4a06538b91f232b74de783067fd8421c7f63ed74df
-
SHA512
018a8ada09dc8c65cdc719effb63ec994cb181383fd626a9fbf9287dd76dd205520ef44a07d2fb51e4b735efcd733df4d758c9ca5650435776a7ffc2a9e574e3
-
SSDEEP
3072:dNpXnl6w1dx8Vq0kJkHI7cpEEOPOKZXoX/Lw1QlGBy:/pXl6w1dX4pahovFgBy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4819ffe03a92f466087131fc1e581f7c_JaffaCakes118
Files
-
4819ffe03a92f466087131fc1e581f7c_JaffaCakes118.dll windows:4 windows x86 arch:x86
65e1e7503412094dbe27aab8a86f4d7e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
CreateFileW
CloseHandle
SetFilePointer
DeleteFileW
GetTempFileNameW
GetTempPathW
LeaveCriticalSection
GetCurrentProcess
WaitForSingleObject
TlsFree
ResetEvent
Sleep
TerminateProcess
UnhandledExceptionFilter
InterlockedDecrement
CompareStringA
ReadFile
SetUnhandledExceptionFilter
LocalFree
LocalReAlloc
InterlockedExchange
lstrlenW
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GlobalUnlock
InterlockedCompareExchange
SetLastError
FormatMessageW
GetCurrentThreadId
GlobalFree
GetCommandLineA
VirtualProtect
InterlockedIncrement
GlobalAlloc
user32
SendMessageW
CharUpperW
LoadStringW
GetClassLongW
IsWindowUnicode
DefWindowProcW
IsDlgButtonChecked
GetDlgItemTextW
CheckDlgButton
MessageBoxW
EndDialog
DefWindowProcA
SetWindowLongW
WinHelpW
EnableWindow
GetDlgItem
advapi32
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegOpenCurrentUser
RegCloseKey
ole32
ReleaseStgMedium
CoTaskMemFree
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
StringFromGUID2
CoGetStandardMarshal
msvcr71
_amsg_exit
memset
_XcptFilter
_wcsicmp
realloc
free
malloc
_wtoi
wcsstr
memmove
memcpy
_onexit
_adjust_fdiv
__CppXcptFilter
__dllonexit
_initterm
_except_handler3
Sections
.text Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ