Static task
static1
Behavioral task
behavioral1
Sample
11f38b6a69978dad95c9b1479db9a8729ca57329855998bd41befc364657d654.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
11f38b6a69978dad95c9b1479db9a8729ca57329855998bd41befc364657d654.dll
Resource
win10v2004-20240802-en
General
-
Target
85a4593b9f0721a26404026af53ca16d_JaffaCakes118
-
Size
279KB
-
MD5
85a4593b9f0721a26404026af53ca16d
-
SHA1
99926179b2eeb84b58425862e6b5c5995c97c499
-
SHA256
79552b5a428189cebd4d8a5dd8c69909a905eb2bdd27b325363272613963b1f5
-
SHA512
faf82df38713cf0e5274ce9573856d8fdeccc2adae425fceac8b58f0d7f52659d6b225b2d684afc247938440680431636bea52fee5e5d8c1da14129c68c038d1
-
SSDEEP
6144:lMt3buymE0ycPxt770fMvx3rXlQeAtU65Q0/aVtqTSWp96v92:lMt3bu0cPgfMpD16a0+typH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/11f38b6a69978dad95c9b1479db9a8729ca57329855998bd41befc364657d654
Files
-
85a4593b9f0721a26404026af53ca16d_JaffaCakes118.zip
Password: infected
-
11f38b6a69978dad95c9b1479db9a8729ca57329855998bd41befc364657d654.dll windows:5 windows x86 arch:x86
e9ed2f25d7b733ed82dc21e434ebeb67
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
OutputDebugStringA
GetLastError
FreeLibrary
LoadLibraryA
CreateFileA
WriteFile
OpenProcess
Sleep
TerminateProcess
Process32FirstW
GetModuleFileNameA
Process32NextW
GetModuleHandleA
VirtualProtect
MultiByteToWideChar
WinExec
CloseHandle
DeleteFileW
GetCurrentProcessId
GetSystemTime
LocalFree
GetProcAddress
LoadLibraryW
WideCharToMultiByte
InitializeCriticalSection
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetFullPathNameW
GetFullPathNameA
GetFileAttributesW
DeleteFileA
CreateToolhelp32Snapshot
GetModuleHandleW
HeapAlloc
InterlockedDecrement
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
DecodePointer
GetCommandLineA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
ExitProcess
GetStdHandle
GetModuleFileNameW
HeapCreate
HeapDestroy
InitializeCriticalSectionAndSpinCount
RtlUnwind
DeleteCriticalSection
ReadFile
SetHandleCount
GetFileType
GetStartupInfoW
SetFilePointer
RaiseException
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetStringTypeW
LCMapStringW
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CreateFileW
HeapReAlloc
SetStdHandle
FlushFileBuffers
IsProcessorFeaturePresent
HeapSize
WriteConsoleW
SetEndOfFile
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
GetVersionExA
AreFileApisANSI
GetFileSize
LockFile
LockFileEx
UnlockFile
GetTempPathA
GetTempPathW
FormatMessageA
GetFileAttributesA
user32
IsCharAlphaNumericW
advapi32
CredEnumerateA
CredFree
psapi
GetModuleFileNameExW
wininet
HttpSendRequestW
InternetSetOptionW
HttpQueryInfoW
InternetQueryOptionW
crypt32
CryptUnprotectData
oleaut32
GetErrorInfo
Sections
.text Size: 414KB - Virtual size: 414KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 55KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ