Static task
static1
Behavioral task
behavioral1
Sample
705a662c503a41b5b54f6921a307b2c7_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
705a662c503a41b5b54f6921a307b2c7_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
705a662c503a41b5b54f6921a307b2c7_JaffaCakes118
-
Size
311KB
-
MD5
705a662c503a41b5b54f6921a307b2c7
-
SHA1
28377be9d9aa2a79316e356b5a52be6438cda344
-
SHA256
f7b3d750e27f1f755cda037e2ae7cb35a72a21bd9a6f18320e4e7b729c805deb
-
SHA512
050d88f8d536ed27f7163e7d73ce3599484e3e60bb5d62a4d68bed1a43862004fed9736a25523e7caeb3eaaf36139ec402bf6ae6c104075b172d245e5d8bc3c5
-
SSDEEP
6144:3gIZrqBSESDU1hBtDD9eoHTAz2Yt6eJQExQE9WtAKSw6uOOUj:3gDkKDDPN9BcQEItKka
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 705a662c503a41b5b54f6921a307b2c7_JaffaCakes118
Files
-
705a662c503a41b5b54f6921a307b2c7_JaffaCakes118.dll windows:4 windows x86 arch:x86
a105e42da7b521f2f6a15056183f6b60
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CreateFileA
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileA
FreeLibrary
GetCommandLineA
GetCurrentThreadId
GetFileSize
GetFileType
GetLastError
GetModuleFileNameA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalAlloc
LocalFree
OpenMutexA
OpenProcess
ReadFile
ResumeThread
SetEndOfFile
SetFilePointer
Sleep
TerminateThread
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
user32
BeginPaint
CheckMenuRadioItem
CheckRadioButton
CreateMenu
CreateWindowExA
DestroyCursor
DestroyWindow
EndPaint
ExitWindowsEx
FindWindowExA
GetCapture
GetCursorPos
GetDC
GetSystemMetrics
GetWindow
GetWindowDC
GetWindowDC
GetWindowTextA
GetWindowTextLengthA
InvalidateRect
IsWindow
KillTimer
LoadCursorA
LoadIconA
LoadStringA
MessageBoxA
PeekMessageA
PostMessageA
PostQuitMessage
RegisterClassA
ReleaseCapture
ReleaseDC
SendMessageA
SetCursor
wvsprintfA
gdi32
CombineRgn
CreateBrushIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
SetWindowOrgEx
StretchBlt
TextOutA
shell32
DllRegisterServer
DllUnregisterServer
ShellExecuteA
SHGetPathFromIDList
comdlg32
ChooseFontA
Sections
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: 25KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CODE Size: 158KB - Virtual size: 456KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ