Static task
static1
Behavioral task
behavioral1
Sample
8897160d9765702f29629b2c30f43ca4_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8897160d9765702f29629b2c30f43ca4_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8897160d9765702f29629b2c30f43ca4_JaffaCakes118
-
Size
92KB
-
MD5
8897160d9765702f29629b2c30f43ca4
-
SHA1
e70e0b2fad6f776d3a50a1f07d4cf8e47649d1aa
-
SHA256
1a7707ed7b0b6925c637f1f3010e35e955f9142d9b7fbf53e24c0f458a71386b
-
SHA512
767f693e20c8c0bb8708cfab0f66649a7de0e1c0f6c600fc062928ae773bbc995ac569f912d02fb27537c212b5ee6dbb833616d6a77d723246e91fa8565259e3
-
SSDEEP
1536:lUkjAkgPKHLV0B0cb+lhr50ZzefSUf7UwdjUy3RZ8U4iTm:Z5BqNba7KzU7UEgYZ8vk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8897160d9765702f29629b2c30f43ca4_JaffaCakes118
Files
-
8897160d9765702f29629b2c30f43ca4_JaffaCakes118.dll windows:4 windows x86 arch:x86
614b8902b3e3e4c37a2ed1f8cc385e38
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CreateNamedPipeW
ExitProcess
GetACP
GetCommandLineA
GetModuleHandleA
GetStartupInfoA
GetVersionExA
HeapAlloc
HeapCreate
ResetEvent
RtlUnwind
SizeofResource
Sleep
WinExec
lstrcpynW
user32
TrackPopupMenu
UpdateWindow
LoadMenuA
GetCapture
FrameRect
DrawIconEx
ClientToScreen
TrackPopupMenuEx
comctl32
ImageList_AddMasked
InitializeFlatSB
ImageList_Write
DrawStatusTextA
FlatSB_EnableScrollBar
FlatSB_SetScrollRange
GetMUILanguage
ImageList_SetFlags
ImageList_DragShowNolock
ole32
CoGetMalloc
CoTaskMemAlloc
CoTaskMemFree
CreateAntiMoniker
StringFromGUID2
CoFileTimeNow
CoCreateInstance
CoCreateGuid
CLSIDFromString
CoBuildVersion
dbghelp
SymLoadModule64
SymGetOptions
SymGetLinePrev64
SymGetModuleBase64
ImageNtHeader
ImageDirectoryEntryToData
FindExecutableImage
oleaut32
SysReAllocString
SafeArrayAllocDescriptor
SafeArrayAccessData
RevokeActiveObject
OleLoadPicturePath
Sections
.text Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ