Static task
static1
Behavioral task
behavioral1
Sample
6308feb05e7e23120bb51053d23c82c2_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6308feb05e7e23120bb51053d23c82c2_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6308feb05e7e23120bb51053d23c82c2_JaffaCakes118
-
Size
89KB
-
MD5
6308feb05e7e23120bb51053d23c82c2
-
SHA1
aba31aaebec62aa92d013d65c4a626b3864b056c
-
SHA256
eff09f7df5cfe49ec1fb146e72141894db45a4dd2667d545018609840257aed6
-
SHA512
96f40649eff500de48db4a1231c63b9ece43471c76d895235f1346661bb275a2bba6f1574cf738f3088236b24027690023009ef1a16cda3bfe67fecba13ad865
-
SSDEEP
1536:F8oKQllbZ64QLU5yRJEypbWgaE/GSwIdWwgoUD4vA7jnmDwRfojeo7oZW0y:KojtA4xhypbvulIPIDWA7jneHjeo7o/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6308feb05e7e23120bb51053d23c82c2_JaffaCakes118
Files
-
6308feb05e7e23120bb51053d23c82c2_JaffaCakes118.dll windows:4 windows x86 arch:x86
f7b37dabb17ac091ae973663a42a4c95
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
GetProcAddress
LoadLibraryW
InterlockedCompareExchange
WideCharToMultiByte
GetModuleFileNameA
GetModuleHandleA
InterlockedExchange
FreeLibrary
CloseHandle
UnmapViewOfFile
CreateFileA
DeleteFileA
WriteFile
InterlockedIncrement
InterlockedDecrement
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
lstrcatA
CompareStringA
lstrlenA
GetSystemDefaultLangID
GetVersionExA
VirtualProtect
WinExec
lstrcmpiA
GlobalFree
GetWindowsDirectoryA
GetCommandLineA
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
HeapAlloc
HeapFree
RtlUnwind
GetVersion
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStringTypeW
user32
wsprintfA
GetSystemMetrics
WinHelpA
advapi32
RegDeleteKeyA
RegSetValueA
RegQueryValueA
RegOpenKeyA
RegQueryInfoKeyA
RegEnumKeyA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
ole32
CoGetClassObject
StringFromCLSID
CreateFileMoniker
CLSIDFromProgID
CoTaskMemFree
CLSIDFromString
CoCreateInstance
Sections
.text Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ