Static task
static1
Behavioral task
behavioral1
Sample
5dfa5219e3044c5ff4948c5e217388eb_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5dfa5219e3044c5ff4948c5e217388eb_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5dfa5219e3044c5ff4948c5e217388eb_JaffaCakes118
-
Size
345KB
-
MD5
5dfa5219e3044c5ff4948c5e217388eb
-
SHA1
6786c4b13d888b2e4c2a1c3b2a5daac4bce03ae6
-
SHA256
c556c9a28813e17abd7ede6f6e2a4ffd3f8668c4c10750a76afbcb3531347a69
-
SHA512
69060dca82957ebe3e9588ca0c10c09e8d40bc3a58c6e90c18c875264ff022b17d8a94ba285788150778e1b4f50b39446a66378e3f480217ed1b73ea12d7326c
-
SSDEEP
6144:15Z5W2DQqdl927mykGVoxNNfpAvImRn85gihH8YSgy1cig7+9wILZ:B5VDPlmmyTVoDN2vIZYgU2ANL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5dfa5219e3044c5ff4948c5e217388eb_JaffaCakes118
Files
-
5dfa5219e3044c5ff4948c5e217388eb_JaffaCakes118.dll windows:5 windows x86 arch:x86
2b4caf158a7f50a08c84ec702cc3183f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
NtQueryVirtualMemory
RtlUnwind
wcscmp
sprintf
wcschr
wcsncmp
wcsncpy
iswctype
wcsrchr
memmove
_chkstk
wcscat
_wcsicmp
swprintf
_vsnprintf
wcslen
_alloca_probe
wcscpy
towlower
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
winsta
WinStationQueryInformationW
WinStationEnumerateW
WinStationFreeMemory
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
setupapi
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
kernel32
CreateDirectoryW
CompareStringW
DisableThreadLibraryCalls
SetLastError
CloseHandle
OpenProcess
MultiByteToWideChar
HeapFree
GetProcessHeap
DeleteFileW
SetEvent
GetThreadContext
OpenThread
GetLastError
WriteFile
SetFilePointer
GetModuleFileNameW
GetSystemTime
CreateFileW
GetSystemDirectoryW
GetModuleHandleA
HeapAlloc
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
LoadLibraryA
GetCurrentProcessId
SystemTimeToFileTime
ReleaseMutex
WaitForSingleObject
OpenMutexW
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
DeviceIoControl
GetSystemWindowsDirectoryW
FreeLibrary
GetProcAddress
GetDriveTypeW
QueryDosDeviceW
GetLogicalDriveStringsW
GetCurrentProcess
GetTickCount
GetTempPathW
UnmapViewOfFile
WaitForMultipleObjects
CreateProcessW
GetUserDefaultUILanguage
GetCurrentThreadId
MapViewOfFile
CreateFileMappingA
SetNamedPipeHandleState
CreateMutexA
CreateEventA
GetExitCodeProcess
ExpandEnvironmentStringsW
WideCharToMultiByte
GetLongPathNameW
LoadLibraryExW
GetACP
ResumeThread
Thread32Next
SuspendThread
Thread32First
GetCurrentThread
CopyFileW
GetTempFileNameW
GetFileAttributesExW
FindClose
FindNextFileW
FindFirstFileW
GetSystemDefaultLangID
GetVersionExW
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrcpyW
lstrlenW
DeleteCriticalSection
RemoveDirectoryW
GetFileSize
WaitNamedPipeW
GetOverlappedResult
TransactNamedPipe
CreateEventW
DuplicateHandle
user32
GetProcessWindowStation
wsprintfW
GetSystemMetrics
LoadStringW
OpenWindowStationW
CloseWindowStation
GetUserObjectInformationW
advapi32
GetSecurityDescriptorDacl
AddAccessDeniedAce
DuplicateToken
GetLengthSid
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
AccessCheck
RegDeleteKeyW
RegEnumKeyExW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
CreateProcessAsUserW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
AllocateAndInitializeSid
FreeSid
LookupAccountNameW
OpenProcessToken
GetTokenInformation
IsValidSid
EqualSid
OpenThreadToken
RevertToSelf
SetThreadToken
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyA
RegEnumValueW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
Sections
.text Size: 41KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 286KB - Virtual size: 731KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ