Static task
static1
Behavioral task
behavioral1
Sample
6187952084f1f60d2ea303d9f21422aa_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6187952084f1f60d2ea303d9f21422aa_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6187952084f1f60d2ea303d9f21422aa_JaffaCakes118
-
Size
85KB
-
MD5
6187952084f1f60d2ea303d9f21422aa
-
SHA1
0063b04660b2eaf322fb350ce5e527e398997af0
-
SHA256
6d6c15240d5cd39948c739fbcc39be4b518e886a3ae4ecdb3c28ecf5f0509473
-
SHA512
d9e8eea3ae658982a63ee1b8a3dda034c1b31bbe1f20c6d92be09d3e53cfc80f60493d046b746251ebbef0711ecfc1200ba282ca8bd052b146c4cf8a7237bc48
-
SSDEEP
768:tgn+MS4Hutjk9WJuZ2RMCvvvjATInizN34l+B+3FFIHTau5amLtJKZa:en+MSjkI47C/CI04lvFIHTauFtkZa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6187952084f1f60d2ea303d9f21422aa_JaffaCakes118
Files
-
6187952084f1f60d2ea303d9f21422aa_JaffaCakes118.dll windows:4 windows x86 arch:x86
ee481b265ae5a1e6aa8e8e37b821b939
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetStdHandle
CreateThread
TerminateProcess
HeapSize
GetACP
GetTimeZoneInformation
ExitThread
GetFileType
HeapReAlloc
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
RaiseException
HeapAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
ReadFile
SetFilePointer
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
HeapFree
GetCommandLineA
GetStartupInfoA
RtlUnwind
FileTimeToSystemTime
GetTickCount
FileTimeToLocalFileTime
SetErrorMode
GetFileAttributesA
GetFileTime
GetFileSize
GetFullPathNameA
FindClose
GetVolumeInformationA
FindFirstFileA
SetEndOfFile
FlushFileBuffers
UnlockFile
LockFile
HeapDestroy
WriteFile
GlobalGetAtomNameA
GlobalAddAtomA
GetVersion
FormatMessageA
LocalFree
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
InterlockedDecrement
InterlockedIncrement
lstrcmpA
GetVersionExA
GetCurrentThreadId
lstrcpyA
lstrcatA
CreateProcessA
WaitForSingleObject
GetPrivateProfileSectionA
ExitProcess
WritePrivateProfileStringA
GetModuleFileNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
IsBadReadPtr
GetCurrentProcess
DuplicateHandle
GetProfileStringA
GetThreadLocale
SizeofResource
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLastError
GlobalAlloc
GetCurrentThread
MulDiv
SetLastError
CreateEventA
SuspendThread
SetThreadPriority
ResumeThread
SetEvent
CloseHandle
GlobalFree
LoadLibraryA
FreeLibrary
FindResourceA
LoadResource
LockResource
lstrcmpiA
GlobalFindAtomA
GlobalDeleteAtom
GetModuleHandleA
GetProcAddress
GlobalLock
lstrcpynA
GlobalUnlock
IsBadCodePtr
HeapCreate
VirtualFree
VirtualAlloc
OutputDebugStringA
gdi32
DeleteObject
GetDeviceCaps
GetViewportExtEx
CreatePen
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetMapMode
DPtoLP
GetTextColor
GetBkColor
LPtoDP
CreateDIBitmap
CreateCompatibleDC
BitBlt
GetTextExtentPointA
IntersectClipRect
SetWindowExtEx
ScaleWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
SetViewportOrgEx
SetMapMode
OffsetViewportOrgEx
GetStockObject
SetBkMode
RestoreDC
SaveDC
SelectObject
DeleteDC
CreateBitmap
GetObjectA
PatBlt
SetTextColor
GetClipBox
SetBkColor
GetWindowExtEx
CreateSolidBrush
Rectangle
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
shell32
DragQueryFileA
DragFinish
comctl32
ord17
oledlg
ord8
ole32
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoTaskMemFree
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
StgOpenStorageOnILockBytes
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoTaskMemAlloc
olepro32
ord253
oleaut32
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantChangeType
SysAllocString
VariantCopy
VariantTimeToSystemTime
VariantClear
SysAllocStringLen
Sections
.text Size: 25KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 64KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.shared Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mstp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DATA Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
DATA Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ