Static task
static1
Behavioral task
behavioral1
Sample
76795e99bda6328e9dfdd0b6c644f3c6_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
76795e99bda6328e9dfdd0b6c644f3c6_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
76795e99bda6328e9dfdd0b6c644f3c6_JaffaCakes118
-
Size
100KB
-
MD5
76795e99bda6328e9dfdd0b6c644f3c6
-
SHA1
282c83640e16265a9b6c4e4fdfe0ec8b84aca633
-
SHA256
4cecdd8a870cd1425b5985007999b52ced5f4504b37ae247db079481035068d8
-
SHA512
02685f862f8626f8bd10936a69729c0ccd5d0f2478f9df51653c62f6a28bdb97a5ba340b7a21c179e40b8344ec169534dfb1a53746259f6c22490552567b5475
-
SSDEEP
3072:xviudr7GbZ6lLXZDy0IqkwkLQ1HswIkD:xvBdr7QcLXZDJRYM1M6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 76795e99bda6328e9dfdd0b6c644f3c6_JaffaCakes118
Files
-
76795e99bda6328e9dfdd0b6c644f3c6_JaffaCakes118.dll windows:4 windows x86 arch:x86
bd19e2287ce3c8e77de5b0c062ea7849
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
MapViewOfFileEx
CreateFileMappingW
CreateFileW
Sleep
CreateThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetProcessHeap
HeapFree
lstrcpynA
GetModuleFileNameA
lstrlenW
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
CloseHandle
lstrlenA
FormatMessageA
lstrcatA
lstrcpyA
FindClose
FindNextFileA
GetTimeZoneInformation
DisableThreadLibraryCalls
FreeLibrary
GetProcAddress
LoadLibraryA
SetFilePointer
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetEndOfFile
WideCharToMultiByte
MultiByteToWideChar
SetLastError
GetTickCount
GetLocalTime
HeapDestroy
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
LocalFree
LocalAlloc
VirtualProtect
GlobalFree
GetCommandLineA
GetCurrentThread
GlobalAlloc
user32
IsWindow
CharPrevA
LoadStringA
GetClientRect
wsprintfA
advapi32
RegCloseKey
RegQueryValueExA
RegSetValueExA
FreeSid
RegSetValueExW
GetSecurityDescriptorLength
OpenThreadToken
SetThreadToken
RevertToSelf
RegCreateKeyExA
ole32
CLSIDFromString
CoCreateInstance
CoTaskMemFree
msvcr71
atoi
__dllonexit
__CppXcptFilter
_adjust_fdiv
malloc
_initterm
free
isdigit
strchr
_except_handler3
strrchr
_vsnprintf
_snprintf
_ultoa
_onexit
fclose
strncmp
wcslen
isspace
fprintf
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ