Static task
static1
Behavioral task
behavioral1
Sample
64154db16fc975aafd97351a5f20b26c_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
64154db16fc975aafd97351a5f20b26c_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
64154db16fc975aafd97351a5f20b26c_JaffaCakes118
-
Size
96KB
-
MD5
64154db16fc975aafd97351a5f20b26c
-
SHA1
95ebea1754121a5e3a20c086359f270d184abd89
-
SHA256
3bf559b95f6576e20e7b60be368dce572e3857f4e80d78e8dcf51945395deaab
-
SHA512
f1f6e658d79304f89cfc7126f787798547bcb830aaacf6c35055117e37c41f2d11977a756b83df97ff9a0bf4a07a39edfbd26b1f69b34a9a75f43c48e98acc30
-
SSDEEP
1536:HB8LGFJWzyTUQ1wTki+zeJTSMa2Z4b3Gqtw1hn/Zw:HWgDSyg/Z4aqtw1hn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 64154db16fc975aafd97351a5f20b26c_JaffaCakes118
Files
-
64154db16fc975aafd97351a5f20b26c_JaffaCakes118.dll windows:4 windows x86 arch:x86
1117138d162d70ca49b1c6b061f4e984
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
LoadLibraryW
GetProcAddress
GetModuleHandleA
lstrcpynA
GetLastError
GetSystemDefaultLangID
CloseHandle
TerminateProcess
Sleep
GlobalFree
GlobalAlloc
GetVersionExA
GlobalMemoryStatus
WideCharToMultiByte
MultiByteToWideChar
ExpandEnvironmentStringsA
DeleteFileA
DisableThreadLibraryCalls
CreateThread
lstrcpyA
MoveFileExA
GetCurrentProcess
ExitProcess
CompareStringW
CompareStringA
SetEndOfFile
GetStringTypeW
HeapFree
HeapAlloc
GetTimeZoneInformation
GetSystemTime
GetLocalTime
RtlUnwind
GetCommandLineA
GetVersion
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
WriteFile
ReadFile
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
InterlockedDecrement
InterlockedIncrement
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
CreateFileA
GetStringTypeA
SetEnvironmentVariableA
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
shell32
DoEnvironmentSubstA
shlwapi
PathFileExistsA
iphlpapi
GetAdaptersInfo
ws2_32
inet_ntoa
inet_addr
Sections
.text Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ