Static task
static1
Behavioral task
behavioral1
Sample
4c62b03a7a4fa74ee6905f18459463a9_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4c62b03a7a4fa74ee6905f18459463a9_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4c62b03a7a4fa74ee6905f18459463a9_JaffaCakes118
-
Size
128KB
-
MD5
4c62b03a7a4fa74ee6905f18459463a9
-
SHA1
8e2fd39024457dc0ec82e11c8dfa526624f3a913
-
SHA256
745d8eca66e5b4ca7448248383cc40b0f068c17eda8263f6b667e6861233cb92
-
SHA512
bbab607b1170f45d30a9525c7c9efb345554c4a417c94c30bc7f79a4a0bfe200cf34924ed12ed4e1c15cfd53dc21d6fd5d0dc2421b1daf2da68595f4b5ca1c32
-
SSDEEP
1536:Pd0O/wnOVskebZpbZfwxdWRQGIbWEqWu7Z/iaFR4y5R1ObwIOOFnToIf+02x7:aOlz6pNf0RWEqpKErRIyOtTBf+02x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4c62b03a7a4fa74ee6905f18459463a9_JaffaCakes118
Files
-
4c62b03a7a4fa74ee6905f18459463a9_JaffaCakes118.dll windows:4 windows x86 arch:x86
fb17f1a60e917ecad4c83b434b49af52
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegEnumValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCreateKeyExW
ole32
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
oleaut32
SysStringLen
SysAllocString
SysFreeString
shlwapi
PathAppendW
PathAddBackslashW
PathFileExistsW
shell32
SHGetFileInfoW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetDesktopFolder
user32
wsprintfW
wsprintfA
wvsprintfA
wininet
InternetErrorDlg
InternetSetFilePointer
HttpQueryInfoW
InternetQueryDataAvailable
InternetReadFile
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetOpenW
InternetOpenUrlW
InternetCloseHandle
InternetGetConnectedState
InternetSetOptionW
ws2_32
WSACleanup
WSAStartup
closesocket
ntohs
recv
select
htons
socket
sendto
gethostbyname
inet_addr
gethostname
send
connect
ntohl
msvcrt
_wcsdup
_ftol
ctime
localtime
fread
realloc
fwrite
fseek
_wtoi
sprintf
memcpy
memset
_initterm
_adjust_fdiv
tolower
wcsstr
isxdigit
toupper
isdigit
swprintf
_wcsicmp
_wfopen
strstr
strchr
fgets
fclose
wcschr
wcscat
??2@YAPAXI@Z
time
srand
??3@YAXPAX@Z
_wcslwr
_wsplitpath
wcscmp
malloc
wcslen
wcscpy
rand
_except_handler3
_strcmpi
_filelength
free
_fileno
kernel32
GetCurrentThreadId
EnterCriticalSection
GetVersion
CreateProcessW
GetPrivateProfileStringW
GetVolumeInformationW
CreateToolhelp32Snapshot
Process32FirstW
GetPriorityClass
Process32NextW
GetSystemDirectoryA
OpenProcess
CreateRemoteThread
GetModuleHandleA
LoadLibraryA
GetCurrentProcessId
CreateFileA
lstrcpyA
SetFileAttributesA
lstrlenA
IsBadReadPtr
VirtualProtect
VirtualProtectEx
WriteProcessMemory
ReadProcessMemory
VirtualFreeEx
VirtualAllocEx
GetModuleHandleW
lstrcpynA
WriteFile
GetFileAttributesW
SetFilePointer
GetTempPathW
GetTickCount
GetTempFileNameW
GetLogicalDriveStringsW
GetDriveTypeW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetFileSize
WideCharToMultiByte
GetProcAddress
FindFirstFileW
FindNextFileW
FindClose
ReadFile
SetThreadPriority
GetWindowsDirectoryW
GetEnvironmentVariableW
LeaveCriticalSection
SetEvent
DisableThreadLibraryCalls
lstrcatW
GetFileTime
MultiByteToWideChar
GetModuleFileNameW
SetFileTime
WaitForSingleObject
CreateEventW
InitializeCriticalSection
GetSystemDirectoryW
lstrlenW
WaitForMultipleObjects
DeleteCriticalSection
LoadLibraryW
CreateFileW
DeleteFileW
MoveFileW
MoveFileExW
FreeLibraryAndExitThread
GetCurrentProcess
GetCurrentThread
DuplicateHandle
Sleep
CreateThread
CloseHandle
Sections
.text Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ