Static task
static1
Behavioral task
behavioral1
Sample
5d09a16fd53b05641f6fd43ab3836250_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5d09a16fd53b05641f6fd43ab3836250_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5d09a16fd53b05641f6fd43ab3836250_JaffaCakes118
-
Size
482KB
-
MD5
5d09a16fd53b05641f6fd43ab3836250
-
SHA1
428d9318c143dc5ac8e3d4fd739ba662f57c3db9
-
SHA256
e6d2fa1809e9ceeae554e53e1c888ebbb7d278a2d14dfadc1d870ebf79bec345
-
SHA512
7362ff08f34401ddbf0a164144cde711737c7e8c168b610b92c070cf2bb09fd95e79c87647107561d04983d0384a5c59f0a97a57aa99914aa9285c07182a2486
-
SSDEEP
6144:PdHtCVeJ6DA8nvyWqkZiFs/rSFw4aLW7yot/Q7Z5LTJeDhe24nRCsOx:PdHtCVeJ6kDDF6tRLxotAZ1Je9yE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d09a16fd53b05641f6fd43ab3836250_JaffaCakes118
Files
-
5d09a16fd53b05641f6fd43ab3836250_JaffaCakes118.dll windows:4 windows x86 arch:x86
4d00a358ea254425e57f33851389a5fc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
lstrlenW
GetVersion
lstrcmpiA
lstrcmpiW
lstrlenA
CompareStringA
CompareStringW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStringTypeExA
GetStringTypeExW
GetTempPathA
GetLastError
GetVolumeInformationA
IsBadStringPtrA
CloseHandle
WriteFile
CreateFileA
GetTickCount
Sleep
MoveFileA
DeleteFileA
ReadFile
GetFileSize
CopyFileA
CreateThread
CreateMutexA
RaiseException
WideCharToMultiByte
MultiByteToWideChar
SetEnvironmentVariableA
GetLocaleInfoW
SetEndOfFile
GetTimeZoneInformation
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetModuleFileNameA
InterlockedExchange
SetStdHandle
FlushFileBuffers
IsBadCodePtr
GetUserDefaultLCID
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetFilePointer
GetStartupInfoA
GetFileType
SetEvent
OpenEventA
lstrcpyA
lstrcpyW
OutputDebugStringA
OutputDebugStringW
lstrcpynW
GetCurrentProcessId
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
WaitForSingleObject
GetCurrentThreadId
GetModuleFileNameW
InterlockedIncrement
VirtualAlloc
UnmapViewOfFile
IsBadReadPtr
GetSystemInfo
MapViewOfFile
CreateFileMappingA
GetCurrentThread
OpenFileMappingA
InterlockedDecrement
IsBadWritePtr
HeapValidate
VirtualProtect
VirtualQuery
RtlUnwind
ExitProcess
DebugBreak
GetStdHandle
GetProcAddress
LoadLibraryA
GetSystemTimeAsFileTime
GetCommandLineA
LCMapStringA
LCMapStringW
GetOEMCP
GetCPInfo
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
SetLastError
FatalAppExitA
HeapCreate
VirtualFree
TerminateProcess
GetCurrentProcess
QueryPerformanceCounter
SetConsoleCtrlHandler
SetUnhandledExceptionFilter
SetHandleCount
user32
TranslateMessage
GetMessageA
GetMessageW
IsWindowUnicode
CharLowerA
CharLowerW
CharUpperA
PeekMessageA
wsprintfW
DispatchMessageW
UnregisterClassA
CharUpperW
DispatchMessageA
MsgWaitForMultipleObjects
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
SetThreadToken
RevertToSelf
OpenThreadToken
RegCreateKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
CoReleaseMarshalData
CoMarshalInterface
CreateStreamOnHGlobal
CoUnmarshalInterface
CoRevokeClassObject
CoRegisterClassObject
oleaut32
SysFreeString
SysAllocString
VariantClear
SysAllocStringLen
VariantInit
shlwapi
PathFileExistsA
wininet
InternetReadFile
InternetOpenUrlA
InternetSetOptionA
InternetOpenA
InternetCloseHandle
Sections
.text Size: 380KB - Virtual size: 379KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ