Static task
static1
Behavioral task
behavioral1
Sample
5ae8331f82dfd42beee0bf53f30561c5_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5ae8331f82dfd42beee0bf53f30561c5_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5ae8331f82dfd42beee0bf53f30561c5_JaffaCakes118
-
Size
94KB
-
MD5
5ae8331f82dfd42beee0bf53f30561c5
-
SHA1
769216c1ef0e789bfbb43d32325d751637527294
-
SHA256
1b36b940ca109cb9f97b7271043447de7fbeaaffe34a6823d83c4c7b096ea9a6
-
SHA512
481f83fafd46e6ea1db54b4d07b23b2a16ffe24070a792aa2aa679b68b59f98050d5400635b594636b9ab8ae79d0c92279265928d03fc335871ea7ad2fb9e9ac
-
SSDEEP
768:FP1u4Os7Rfr+ysOwoFGX9RFehFl+yw22EJurjTs/+THyu5SjwgLP5brOgpwdTmoQ:S4Os9jwoFgMwC4gpUTsqTe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ae8331f82dfd42beee0bf53f30561c5_JaffaCakes118
Files
-
5ae8331f82dfd42beee0bf53f30561c5_JaffaCakes118.dll windows:4 windows x86 arch:x86
178005ba888a3802574967e63304c513
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
_adjust_fdiv
_initterm
?terminate@@YAXXZ
_except_handler3
malloc
wcscmp
free
strchr
strrchr
strcpy
atol
strlen
memcmp
memcpy
abs
__CxxFrameHandler
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
kernel32
GetVersionExA
GetVersion
QueryPerformanceCounter
QueryPerformanceFrequency
SetThreadPriority
SetPriorityClass
GetThreadPriority
GetCurrentThread
GetPriorityClass
SetFilePointer
GetModuleFileNameA
SetProcessShutdownParameters
ExitProcess
GetSystemDirectoryA
GetLocalTime
GetFileAttributesA
GetProcAddress
FreeLibrary
LocalAlloc
InterlockedExchange
RaiseException
GetSystemInfo
GlobalMemoryStatus
GetComputerNameA
lstrcatA
GetCurrentProcessId
DeviceIoControl
CreateProcessA
GetStdHandle
CreatePipe
SetStdHandle
DuplicateHandle
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
GetTickCount
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32First
GetCurrentProcess
Process32Next
lstrcmpiA
FindFirstFileA
lstrcmpA
FindNextFileA
GetLastError
FindClose
GetFileAttributesExA
GetLogicalDriveStringsA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetDriveTypeA
lstrcpyA
CreateDirectoryA
WriteFile
GetTempPathA
GetCurrentThreadId
lstrlenA
SetEvent
WaitForSingleObject
GetFileSize
DeleteFileA
CreateEventA
CreateThread
Sleep
CreateFileA
GetFileSizeEx
SetFilePointerEx
CloseHandle
ReadFile
LoadLibraryA
MoveFileA
psapi
GetModuleFileNameExA
user32
SetProcessWindowStation
OpenWindowStationA
wsprintfA
OpenDesktopA
DispatchMessageA
GetMessageA
DestroyWindow
SendMessageA
IsWindow
ExitWindowsEx
OpenInputDesktop
ToAscii
GetKeyboardState
CallNextHookEx
SendInput
SetThreadDesktop
PostMessageA
SetCursorPos
CharUpperA
GetActiveWindow
GetWindowTextA
SetWindowsHookExA
gdi32
GetCurrentObject
CreateDCA
GetDeviceCaps
DeleteDC
shell32
ShellExecuteA
SHFileOperationA
SHEmptyRecycleBinA
ws2_32
connect
socket
WSAStartup
send
inet_addr
setsockopt
gethostbyname
inet_ntoa
closesocket
htons
recv
ole32
CreateStreamOnHGlobal
shlwapi
StrRChrA
StrToIntA
SHDeleteKeyA
StrCmpNIA
StrChrA
wininet
InternetCloseHandle
HttpQueryInfoA
InternetReadFile
InternetOpenA
InternetOpenUrlA
avicap32
capGetDriverDescriptionA
capCreateCaptureWindowA
advapi32
LookupPrivilegeValueA
OpenProcessToken
ChangeServiceConfigA
RegCreateKeyExA
SetServiceStatus
RegisterServiceCtrlHandlerA
ImpersonateSelf
OpenThreadToken
CreateServiceA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
QueryServiceConfigA
EnumServicesStatusA
DeleteService
StartServiceA
ControlService
OpenSCManagerA
OpenServiceA
CloseServiceHandle
AdjustTokenPrivileges
mswsock
TransmitFile
Sections
.data Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.asprl Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ