Setup
Behavioral task
behavioral1
Sample
78b7e3cedb57ef4cf08f60438b3496c4_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
78b7e3cedb57ef4cf08f60438b3496c4_JaffaCakes118.dll
Resource
win10v2004-20240729-en
General
-
Target
78b7e3cedb57ef4cf08f60438b3496c4_JaffaCakes118
-
Size
60KB
-
MD5
78b7e3cedb57ef4cf08f60438b3496c4
-
SHA1
d29ec122d44331a6d51b045140788638584ee659
-
SHA256
817de6a2e9873a1057ecff8dcd391a46a59e1e4e9963adcfa33f1a19afac84eb
-
SHA512
73b69a3d1b8025a58f0efdf54ff68738f01c3ba1489ed4e8f245582a246d1998b61049a222ee85a0ee85456a9b52d45f358a67bac7f7044c4c53a55cee3a8346
-
SSDEEP
768:N4ysqlQsMMLGODvM/nFJAM4CAle07OVpB/eQI+:tsqlQvEG/4Fc0Sj
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 78b7e3cedb57ef4cf08f60438b3496c4_JaffaCakes118
Files
-
78b7e3cedb57ef4cf08f60438b3496c4_JaffaCakes118.dll windows:4 windows x86 arch:x86
5f62b0c744196c4f3e28ff9ac87756e3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
WriteProcessMemory
WinExec
WaitForSingleObject
VirtualQueryEx
VirtualProtect
VirtualFree
VirtualAlloc
Sleep
SetLastError
SetFileAttributesA
ResumeThread
ReadProcessMemory
OutputDebugStringA
OpenProcess
OpenFileMappingA
MapViewOfFile
LoadLibraryA
InitializeCriticalSection
GetWindowsDirectoryA
GetVersion
GetProcAddress
GetPriorityClass
GetModuleHandleA
GetModuleFileNameA
GetExitCodeThread
GetCurrentProcessId
GetCurrentProcess
ExitThread
DeleteFileA
DeleteCriticalSection
CreateRemoteThread
CreateProcessW
CreateProcessA
CreateFileMappingA
CopyFileA
CloseHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
ExitProcess
CreateThread
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32
SysFreeString
SysReAllocStringLen
shell32
ShellExecuteExW
ShellExecuteExA
ShellExecuteW
ShellExecuteA
user32
GetKeyboardType
MessageBoxA
CharNextA
SendMessageA
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpQueryInfoA
HttpOpenRequestA
wsock32
WSACleanup
WSAStartup
gethostname
gethostbyname
Exports
Exports
Sections
UPX0 Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE