testall
Static task
static1
Behavioral task
behavioral1
Sample
5be9f3e89f13f6e6a00a5b283c3ab655_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5be9f3e89f13f6e6a00a5b283c3ab655_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5be9f3e89f13f6e6a00a5b283c3ab655_JaffaCakes118
-
Size
43KB
-
MD5
5be9f3e89f13f6e6a00a5b283c3ab655
-
SHA1
51b91b14e4fb69e131de4cfbe3dc73e264e71f7b
-
SHA256
9e8b05a7e705d0468cc10e53ddd2689df2c304a75180e14a408c8996d0033a27
-
SHA512
b8cd39cb394d082e2cd3a6fe25ba2dc84b1b5e68f4b0b2313174074400c6f3c70c85c026badbce85e795fc630b61c497ccb73bf03e59dde8fd9f3bcd2e330696
-
SSDEEP
768:3ACdsxHSPQvDo1Vwb9xmyuhB36FkWN/7oInrJvcp:3glDo0b9xa36flourJv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5be9f3e89f13f6e6a00a5b283c3ab655_JaffaCakes118
Files
-
5be9f3e89f13f6e6a00a5b283c3ab655_JaffaCakes118.dll windows:4 windows x86 arch:x86
8103af93ea79204444e89001efd6cedc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateFileA
Process32Next
WinExec
Sleep
GetShortPathNameA
OpenProcess
Process32First
CreateToolhelp32Snapshot
lstrcpynA
DeleteFileA
FindResourceA
GetSystemDirectoryA
GetCurrentProcess
WaitForSingleObject
CreateRemoteThread
Module32Next
lstrcmpiA
Module32First
GetModuleFileNameA
LoadResource
LockResource
SizeofResource
WriteFile
FreeResource
CloseHandle
GetSystemDirectoryW
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetLastError
GlobalAlloc
LoadLibraryExA
GlobalFree
FreeLibrary
DeviceIoControl
lstrcatA
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
VirtualAlloc
HeapAlloc
RtlUnwind
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeW
advapi32
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyA
RegSetValueExA
RegCloseKey
DeleteService
CreateServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ControlService
StartServiceA
shell32
ShellExecuteA
shlwapi
StrCatW
PathFileExistsA
psapi
EnumProcessModules
GetModuleFileNameExA
Exports
Exports
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ