Static task
static1
Behavioral task
behavioral1
Sample
663b05a080314e455a829922dd879606_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
663b05a080314e455a829922dd879606_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
663b05a080314e455a829922dd879606_JaffaCakes118
-
Size
132KB
-
MD5
663b05a080314e455a829922dd879606
-
SHA1
11470bd8b8b349ccb269d895ca8157e24a5c6ebd
-
SHA256
112c39dad2f8eecf99cdbad79a40aa494bef060981f5d4959017f696d38a712f
-
SHA512
b85344410d7726d1c178cf08152265e7eac854fe23de83a6956560f9f1c28155288a9f7a2a43f9522360d1cc1db684d1489fe1fd300c56883ff0e2333f22b5db
-
SSDEEP
3072:UBmOoViCh4eTcFcWJOMy4DVzfanNQum2IYOXmZnnsX58Pm:sXospeuJRDVz4N9m57XmZsX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 663b05a080314e455a829922dd879606_JaffaCakes118
Files
-
663b05a080314e455a829922dd879606_JaffaCakes118.dll windows:4 windows x86 arch:x86
f82f0a21c63a2c9e3801e3a454669b81
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WaitForSingleObject
CreateFileW
SetFilePointerEx
GetFileSizeEx
DeleteFileW
MoveFileW
ReleaseMutex
CloseHandle
HeapFree
HeapReAlloc
HeapAlloc
LoadLibraryW
SystemTimeToFileTime
FreeLibrary
SetLastError
GetLastError
lstrcatW
lstrlenW
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
lstrcpyW
VirtualFree
GlobalAlloc
VirtualAlloc
GetModuleFileNameA
DisableThreadLibraryCalls
Sleep
lstrcpynA
GlobalFree
GetCommandLineA
VirtualProtect
GetProcAddress
advapi32
RegCreateKeyExA
RegSetValueExW
AllocateAndInitializeSid
FreeSid
SetThreadToken
RegCreateKeyExW
RegQueryValueExW
RegSetValueExA
RegQueryValueExA
RegCloseKey
ole32
CoGetClassObject
StringFromGUID2
CoTaskMemFree
msvcr71
wcscat
__dllonexit
__CppXcptFilter
_except_handler3
strrchr
_snprintf
_adjust_fdiv
malloc
_initterm
free
wcstoul
_wcsicmp
_onexit
towlower
_CxxThrowException
wcslen
wcscpy
iswspace
wcschr
wcstol
swprintf
wcsncpy
Sections
.text Size: 52KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ