Static task
static1
Behavioral task
behavioral1
Sample
5b689e59bb8e8853801f35888d7544be_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5b689e59bb8e8853801f35888d7544be_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5b689e59bb8e8853801f35888d7544be_JaffaCakes118
-
Size
131KB
-
MD5
5b689e59bb8e8853801f35888d7544be
-
SHA1
4412a898e57e03a4bf9664ae2d4db42866e5c4dc
-
SHA256
a240c1b56de37161ec0012e522b603af01cd3c564cb88ba983c9f9744ff9eeb7
-
SHA512
c1aea2fb25463f4edfea69fb86542671a1edfe9e1c146abd4eca115081e877a2ca1e5f038fd8136790f5ac6fb0e69aa2cf8b2b5de49eabe1762b8adb0f5e87c3
-
SSDEEP
1536:JXCRw7f1QIXaFovCL73mzjgucttHirY286WfIYdlAT17M/2KLK5q+kZK5lE+CdPy:JXnPW32cph3wpK6dL5lE+KbgW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b689e59bb8e8853801f35888d7544be_JaffaCakes118
Files
-
5b689e59bb8e8853801f35888d7544be_JaffaCakes118.dll windows:4 windows x86 arch:x86
bd480fbb325c61a6525b763eb19025bb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
QueryPerformanceCounter
SetUnhandledExceptionFilter
InterlockedExchange
GetCurrentThreadId
GetLocaleInfoA
GetStringTypeW
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
Sleep
GetTickCount
lstrlenW
OpenEventW
WaitForSingleObject
CloseHandle
FreeLibrary
GetCurrentProcess
VirtualProtect
UnhandledExceptionFilter
GetCommandLineA
RtlUnwind
GetVersionExA
VirtualQuery
ExitProcess
GetProcAddress
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
HeapAlloc
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
LoadLibraryA
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetSystemInfo
user32
CharUpperW
advapi32
RegLoadKeyW
RegUnLoadKeyW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExW
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ