Static task
static1
Behavioral task
behavioral1
Sample
713c1468de67adf7b68a0933e2c8a824_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
713c1468de67adf7b68a0933e2c8a824_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
713c1468de67adf7b68a0933e2c8a824_JaffaCakes118
-
Size
56KB
-
MD5
713c1468de67adf7b68a0933e2c8a824
-
SHA1
d05fcb6f9d6c5905a2668faca8c306ed6b0baaa5
-
SHA256
0fdf04c49a1ebe9157ecd8fa7155f003741f786bed233bb35608e52d34b0b84b
-
SHA512
8540414a8e774bae7917af422c204962e0725157b6c5c6ed51cb3c3b11c9f89b3868fb6f84896dfb9d498886306816cc1e1a6d62a4320a9670543df64f90b083
-
SSDEEP
768:S5wk4+pUwuOl9nIu3Vfcx0Q4+bxeldUvvK39gvzlbErQgIsdTY:Ewt+p3VIu3w4+ECK39gbyrQehY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 713c1468de67adf7b68a0933e2c8a824_JaffaCakes118
Files
-
713c1468de67adf7b68a0933e2c8a824_JaffaCakes118.dll windows:4 windows x86 arch:x86
24f522f3f8027642c923bdb8d24107fe
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
GetVersionExA
DeleteFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
Sleep
ExitThread
TerminateThread
WaitForMultipleObjects
CreateMailslotA
GetModuleFileNameA
GetLastError
SetEndOfFile
GetProcAddress
OpenProcess
lstrcpyA
lstrcatA
SetEvent
WaitForSingleObject
IsBadReadPtr
ReadFile
lstrlenA
WriteFile
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
LoadLibraryA
ReleaseMutex
WideCharToMultiByte
CreateEventA
CreateMutexW
MultiByteToWideChar
CreateThread
FindClose
FindNextFileA
FindFirstFileA
lstrcmpA
ResetEvent
CompareStringA
GetSystemDirectoryA
CreateDirectoryA
GetTickCount
GetTempFileNameA
GetFileAttributesA
GetWindowsDirectoryA
CloseHandle
SetFileAttributesA
CreateFileA
SetFilePointer
user32
wsprintfA
advapi32
CryptHashData
CryptDeriveKey
CryptEncrypt
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
RegNotifyChangeKeyValue
RegCreateKeyExA
RegSetValueExA
CreateProcessAsUserA
InitializeSecurityDescriptor
CryptAcquireContextA
CryptCreateHash
ImpersonateLoggedOnUser
RegOpenCurrentUser
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RevertToSelf
CryptDecrypt
iphlpapi
GetAdaptersInfo
shell32
SHGetFolderPathA
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ