Static task
static1
Behavioral task
behavioral1
Sample
4a1e6c95a276021e5bba652caf94895d_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4a1e6c95a276021e5bba652caf94895d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4a1e6c95a276021e5bba652caf94895d_JaffaCakes118
-
Size
100KB
-
MD5
4a1e6c95a276021e5bba652caf94895d
-
SHA1
7ffa2b1b447676b4cefe90f8eb2970c1a5438dae
-
SHA256
01fd66d5d06193ddaf0aa321ff047a13d1791130448561f12d4deb21a19639f9
-
SHA512
da634d7e0e4b3c43fec476c428255aadcf0802f97b26c19ace07b23762a57eec7bd584ee9f0257e2d66d46b05292f8d55345e62601d8c82f39edf742031e955a
-
SSDEEP
1536:4Yd482jy3oRiZnaTzNibd09nWxlxeHP+JKh7j3wedzUv:4Yd48p3o04TAbd01Wxlsv3V7HNUv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a1e6c95a276021e5bba652caf94895d_JaffaCakes118
Files
-
4a1e6c95a276021e5bba652caf94895d_JaffaCakes118.dll windows:4 windows x86 arch:x86
4acfa833a24248a0f036770c11c4b87d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
dbghelp
DbgHelpCreateUserDump
kernel32
HeapReAlloc
lstrlenW
CloseHandle
CompareStringA
CompareStringW
CreateEventA
CreateFileA
CreateFileW
CreateMutexA
CreateThread
DeleteCriticalSection
DeleteFileA
DeleteFileW
DeviceIoControl
EnterCriticalSection
EnumSystemLocalesA
ExitProcess
ExitThread
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FlushFileBuffers
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeA
GetEnvironmentStringsW
GetFileAttributesW
GetFileType
GetFullPathNameA
GetFullPathNameW
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetPrivateProfileStringA
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GetWindowsDirectoryA
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
lstrlenA
HeapSize
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsDebuggerPresent
IsValidCodePage
IsValidLocale
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MulDiv
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
ReadFile
ReleaseMutex
ResetEvent
ResumeThread
RtlUnwind
SetEndOfFile
SetEnvironmentVariableA
SetEvent
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualLock
VirtualUnlock
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile
lstrcmpiA
shlwapi
PathRemoveFileSpecA
user32
TranslateMessage
PeekMessageA
DispatchMessageA
CharUpperBuffA
wsprintfA
oleaut32
SafeArrayDestroy
SysStringLen
SysFreeString
SysAllocString
netapi32
DsAddressToSiteNamesA
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ