Static task
static1
Behavioral task
behavioral1
Sample
8a8c79333f168a7a69ef3f40323a2be6_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8a8c79333f168a7a69ef3f40323a2be6_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8a8c79333f168a7a69ef3f40323a2be6_JaffaCakes118
-
Size
132KB
-
MD5
8a8c79333f168a7a69ef3f40323a2be6
-
SHA1
0e48a801cdca6ba41776b5867527f844d69e847a
-
SHA256
29cc8e51230f32e934eaba72fa417de72a5699ed5823416b52025e08627e97af
-
SHA512
4a6d0cb11d5fd7fd6d4d7ed95b85938e0dd662dabe08a39361e58e05be7e8bfee8fce55e40f95d5d0af50397d758442ba63fd8489960c2bccc1feb2b6e60e056
-
SSDEEP
3072:UBmOoViCh4eTcFcWJOMy4DVzfanNR3m2IYOXmZnnsX58Pm:sXospeuJRDVz4NZm57XmZsX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8a8c79333f168a7a69ef3f40323a2be6_JaffaCakes118
Files
-
8a8c79333f168a7a69ef3f40323a2be6_JaffaCakes118.dll windows:4 windows x86 arch:x86
f82f0a21c63a2c9e3801e3a454669b81
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WaitForSingleObject
CreateFileW
SetFilePointerEx
GetFileSizeEx
DeleteFileW
MoveFileW
ReleaseMutex
CloseHandle
HeapFree
HeapReAlloc
HeapAlloc
LoadLibraryW
SystemTimeToFileTime
FreeLibrary
SetLastError
GetLastError
lstrcatW
lstrlenW
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
lstrcpyW
VirtualFree
GlobalAlloc
VirtualAlloc
GetModuleFileNameA
DisableThreadLibraryCalls
Sleep
lstrcpynA
GlobalFree
GetCommandLineA
VirtualProtect
GetProcAddress
advapi32
RegCreateKeyExA
RegSetValueExW
AllocateAndInitializeSid
FreeSid
SetThreadToken
RegCreateKeyExW
RegQueryValueExW
RegSetValueExA
RegQueryValueExA
RegCloseKey
ole32
CoGetClassObject
StringFromGUID2
CoTaskMemFree
msvcr71
wcscat
__dllonexit
__CppXcptFilter
_except_handler3
strrchr
_snprintf
_adjust_fdiv
malloc
_initterm
free
wcstoul
_wcsicmp
_onexit
towlower
_CxxThrowException
wcslen
wcscpy
iswspace
wcschr
wcstol
swprintf
wcsncpy
Sections
.text Size: 52KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ