Static task
static1
Behavioral task
behavioral1
Sample
67ab1bdad67aff98d12a1fb839b1bdee_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
67ab1bdad67aff98d12a1fb839b1bdee_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
67ab1bdad67aff98d12a1fb839b1bdee_JaffaCakes118
-
Size
137KB
-
MD5
67ab1bdad67aff98d12a1fb839b1bdee
-
SHA1
d0c7a5db57c17fecb198ca875a8d03689da63756
-
SHA256
cc7123a515630ae87109c7d69edd49f13b3c68c062158a211749e520fc10c7f8
-
SHA512
5842e4fa898252f1b93fe6271e5acda292ff2241556a51d374bdfab283816d80a10bd4396e7af7ff0ac8c4111965a3f19d55d3eb7a5fd02b39dd412884eeab11
-
SSDEEP
3072:pHNhHzNaPMmRsZTPjNeq8hfMsV60HixKF+/C9yHC5s:pPHZa98TxE8A+/GyHC2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 67ab1bdad67aff98d12a1fb839b1bdee_JaffaCakes118
Files
-
67ab1bdad67aff98d12a1fb839b1bdee_JaffaCakes118.dll windows:4 windows x86 arch:x86
73e65d0e64dc9899e4cb37e6e899f4b1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedExchange
GetProcAddress
GetVersion
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetLocalTime
VirtualAlloc
VirtualProtect
VirtualQuery
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
LoadLibraryA
Sleep
IsDebuggerPresent
SetLastError
GetLastError
GetProcessHeap
GetCurrentThreadId
user32
GetCursor
IsWindowUnicode
GetClientRect
GetWindowTextLengthA
IsCharAlphaNumericA
IsClipboardFormatAvailable
GetDC
WindowFromDC
GetIconInfo
CopyIcon
GetAncestor
GetWindow
GetTopWindow
IsZoomed
IsIconic
GetGUIThreadInfo
GetParent
GetDesktopWindow
InSendMessage
IsMenu
IsChild
advapi32
InitializeSecurityDescriptor
IsValidAcl
GetUserNameA
RevertToSelf
msvcrt
_adjust_fdiv
malloc
_initterm
free
memmove
_swab
_memccpy
_ultoa
srand
_set_error_mode
_errno
_CIpow
_itoa
ldiv
time
ldexp
ceil
_pctype
_isctype
__mb_cur_max
rand
gdi32
GetStretchBltMode
GdiGetBatchLimit
GetROP2
GetBkColor
ole32
CoFileTimeNow
CoGetCurrentProcess
shell32
ord66
DuplicateIcon
ord524
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 61KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ