Static task
static1
Behavioral task
behavioral1
Sample
89a864593fb9a574a3af739b1a9d6d24_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
89a864593fb9a574a3af739b1a9d6d24_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
89a864593fb9a574a3af739b1a9d6d24_JaffaCakes118
-
Size
20KB
-
MD5
89a864593fb9a574a3af739b1a9d6d24
-
SHA1
7d58f3adfaac582c157bd6da41b3c221170e561e
-
SHA256
e19dae6bb67f956290d277aad3bfaa1c06ab661c5ff1642bd0e056add533cee1
-
SHA512
230202c153d2d7fe87715089a38ce85ff94d607b83449458a2913600863fd23258245e7a280bc0f12ff2b619563fdbf677501023cf55b72604ed959d322b7902
-
SSDEEP
384:r+iLvfxguB+G+lGA3rVFMxcuuV5MDvcvnPCxwT9DqLhI:Si6hGvA5+srMsPTT9+2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 89a864593fb9a574a3af739b1a9d6d24_JaffaCakes118
Files
-
89a864593fb9a574a3af739b1a9d6d24_JaffaCakes118.dll windows:4 windows x86 arch:x86
989d79a4b8169b0439b6bc827ed4789b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExitThread
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateThread
WaitForMultipleObjects
lstrcatA
CreateMailslotA
GetModuleFileNameA
GetLastError
DisableThreadLibraryCalls
WaitForSingleObject
GetVersionExA
lstrcpyA
Sleep
ReadFile
GetSystemDirectoryA
DeleteFileA
CreateDirectoryA
GetTickCount
GetTempFileNameA
GetFileAttributesA
lstrlenA
GetProcessHeap
HeapAlloc
HeapReAlloc
SetFilePointer
ReleaseMutex
SetEndOfFile
CreateEventA
CreateMutexA
CreateThread
lstrcmpA
ResetEvent
CompareStringA
HeapFree
OpenProcess
CreateFileA
WriteFile
CloseHandle
SetEvent
user32
wsprintfA
advapi32
RegNotifyChangeKeyValue
CryptDeriveKey
CryptEncrypt
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
CryptDecrypt
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegSetValueExA
OpenProcessToken
CreateProcessAsUserA
RegQueryValueExA
RegCreateKeyExA
CryptHashData
wininet
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
InternetOpenA
InternetGetConnectedState
InternetReadFile
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ