Static task
static1
Behavioral task
behavioral1
Sample
5b981e91e700902b6d270685fbaac830_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5b981e91e700902b6d270685fbaac830_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5b981e91e700902b6d270685fbaac830_JaffaCakes118
-
Size
119KB
-
MD5
5b981e91e700902b6d270685fbaac830
-
SHA1
ad275bb1f372d1be1ee33b571f3789ac55cfa472
-
SHA256
9829f848995c6a47a30cf4946efd92d56a02ebdd7a1415a1650c921d45de12b9
-
SHA512
b5a1bf6054d6112adc60e4dbf30cb41a90aca4d2cd1e2b20964e9294356be8464092a07338a3e7697a405aceb27d1236f4899777c594c26bd59898bf7ef9d134
-
SSDEEP
3072:dpSXJxtFNe5A0so6OkvLMtsZdgI/OuI7ELP6P6NHJIQd0O/TzOXIQB:dpSXJ1o5svLMtsFmuYEjEo7awO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b981e91e700902b6d270685fbaac830_JaffaCakes118
Files
-
5b981e91e700902b6d270685fbaac830_JaffaCakes118.dll windows:4 windows x86 arch:x86
1976746ca47e93b1d4ea14e6509d9c9a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DebugBreak
GetVersionExW
CopyFileW
lstrcatW
LocalAlloc
GetComputerNameW
lstrcmpiW
HeapFree
HeapAlloc
GetProcessHeap
lstrcpyW
lstrcpynW
SetUnhandledExceptionFilter
GetCurrentThread
lstrcmpW
DeleteFileW
CopyFileA
lstrlenA
WritePrivateProfileSectionA
LocalFree
UnhandledExceptionFilter
WideCharToMultiByte
GetConsoleOutputCP
MultiByteToWideChar
GetCurrentProcess
TerminateProcess
GetProcAddress
GetVersionExA
GetLastError
SetFilePointer
GetFileSize
SetLastError
lstrlenW
GetLocaleInfoA
LoadLibraryA
GlobalAlloc
CreateFileA
CreateFileW
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
ReadFile
GetLocalTime
GetCurrentProcessId
IsValidLocale
InterlockedExchange
Sleep
DisableThreadLibraryCalls
InitializeCriticalSection
GetSystemInfo
InterlockedIncrement
VirtualProtect
GlobalFree
GetCommandLineA
CloseHandle
user32
wsprintfW
wsprintfA
advapi32
RegSaveKeyW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RegCloseKey
RegOpenKeyExW
RegConnectRegistryW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LsaNtStatusToWinError
OpenProcessToken
OpenThreadToken
RegRestoreKeyA
RegRestoreKeyW
LsaClose
LsaQueryInformationPolicy
LsaOpenPolicy
LookupAccountNameW
GetSidSubAuthorityCount
GetLengthSid
LsaFreeMemory
LsaRetrievePrivateData
LookupPrivilegeValueW
RegQueryValueExW
CloseServiceHandle
ole32
CoInitializeEx
CoCreateInstanceEx
CoCreateInstance
CoUninitialize
rpcrt4
RpcBindingFree
NdrClientCall2
RpcStringFreeW
UuidFromStringW
UuidToStringW
msvcr71
mbstowcs
__dllonexit
__CppXcptFilter
_initterm
swprintf
_wcsicmp
wcstoul
time
iswctype
wcscmp
_wcsnicmp
atoi
wcsspn
_except_handler3
_adjust_fdiv
wcscpy
wcsncpy
free
malloc
memcpy
memset
memcmp
strchr
_onexit
memmove
_wcsupr
wcstombs
calloc
sprintf
vsprintf
wcsstr
wcscat
wcslen
Sections
.text Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ