Static task
static1
Behavioral task
behavioral1
Sample
8d0b96961d4d52dde9ac56ca15a8ba81_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8d0b96961d4d52dde9ac56ca15a8ba81_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8d0b96961d4d52dde9ac56ca15a8ba81_JaffaCakes118
-
Size
80KB
-
MD5
8d0b96961d4d52dde9ac56ca15a8ba81
-
SHA1
140a7da392a8b9bbbacd695ad1f433ca3d2c9c4b
-
SHA256
d76cb952148fb746b32e6a526bc4306f96245bec934c592253b36b8bc0cfd6ff
-
SHA512
08a1e96968e2a3012622c4af0350fff33b92fac60b3a51d300de0b11a78b491cab04cf0773f6da02d96e699bc52e01845bc87b86fe249c9c76b5c45e90c2b341
-
SSDEEP
1536:PFa3M+eYn3QhOgazxEOnOjWBgu9H5lP5/puw3zkN2hs7h0YW+XzY/:9aFX3bLGkgIrpugzkN2hs6diM/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8d0b96961d4d52dde9ac56ca15a8ba81_JaffaCakes118
Files
-
8d0b96961d4d52dde9ac56ca15a8ba81_JaffaCakes118.dll windows:4 windows x86 arch:x86
e42ddfa6617040360fb2e8eb7a2e6824
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
kernel32
CloseHandle
CopyFileA
CreateEventA
CreateMutexA
DeleteAtom
DeleteCriticalSection
DeviceIoControl
DuplicateHandle
ExitProcess
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FindNextFileA
FormatMessageA
FreeEnvironmentStringsA
GetCPInfo
GetCommandLineA
GetConsoleMode
GetCurrentProcess
GetCurrentThreadId
GetDriveTypeA
GetFileSize
GetLastError
GetLocalTime
GetModuleHandleA
GetOEMCP
GetPrivateProfileSectionA
GetPrivateProfileStructA
GetProcAddress
GetProcessHeap
GetStdHandle
GetStringTypeA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameA
GetThreadLocale
GetTickCount
GetTimeZoneInformation
GetVersionExA
GlobalFree
GlobalLock
GlobalReAlloc
HeapCreate
HeapDestroy
InitializeCriticalSection
InterlockedCompareExchange
IsBadCodePtr
IsBadWritePtr
IsDebuggerPresent
IsValidCodePage
LCMapStringA
LeaveCriticalSection
LoadLibraryA
MoveFileA
OpenEventA
OpenProcess
QueryPerformanceCounter
ReadFile
ReleaseMutex
RtlUnwind
SearchPathA
SetEnvironmentVariableA
SetEvent
SetFileAttributesA
SetFilePointer
SetThreadPriority
SizeofResource
Sleep
TlsAlloc
TlsFree
TlsGetValue
UnmapViewOfFile
VirtualAlloc
VirtualQuery
lstrcatA
lstrcmpiA
lstrcpyA
user32
CharNextA
CharUpperA
CheckDlgButton
DestroyIcon
DestroyWindow
DrawFocusRect
EnableWindow
GetFocus
GetMenuItemCount
GetMessagePos
GetSubMenu
GetSystemMenu
GetWindowDC
IsWindow
IsWindowVisible
MessageBoxA
RegisterClassA
RegisterWindowMessageA
SendDlgItemMessageA
SetDlgItemTextA
SetForegroundWindow
SetMenu
SetTimer
SetWindowTextA
ShowWindow
TrackPopupMenu
UpdateWindow
wsprintfA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CRT Size: 34KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ