KHFMXILZCQC
Static task
static1
Behavioral task
behavioral1
Sample
8d42b9534fe3e51bfcbd634f3bbe5586_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
8d42b9534fe3e51bfcbd634f3bbe5586_JaffaCakes118
-
Size
116KB
-
MD5
8d42b9534fe3e51bfcbd634f3bbe5586
-
SHA1
623a604d9bbf10b6217589f1fdb3040ff3da2ea8
-
SHA256
ba6dfd7029295c899c01a5792698b7fb41d354ea979526862cb6549d6e05054e
-
SHA512
c1ccc9f8e272f6dbf648f407d155f8ae122c514c155cb7f979205d4ef51c64ddb8903111f8aa2454a93873636aef1ec152309422b352ce596f0b7613151160a5
-
SSDEEP
1536:7yR2Gyaxsy8ILM1OCVFMYos6dD1qV60xNNC9xp+C0fYo7vQoYk3yNSRDgCX6:7yRLyaxZLlEFZ6vqVwbp+CeFYSRDgCq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8d42b9534fe3e51bfcbd634f3bbe5586_JaffaCakes118
Files
-
8d42b9534fe3e51bfcbd634f3bbe5586_JaffaCakes118.dll windows:4 windows x86 arch:x86
519518060f4cf705d32508baec929150
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
AccessCheckByTypeResultListAndAuditAlarmByHandleA
CloseEncryptedFileRaw
CloseServiceHandle
CryptReleaseContext
LsaRemovePrivilegesFromAccount
OpenSCManagerW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegUnLoadKeyW
SetThreadToken
SetUserFileEncryptionKey
gdi32
EndPage
GdiGetDC
SetMapperFlags
StartPage
TextOutW
DeleteObject
kernel32
CloseHandle
CreateFileW
DeleteCriticalSection
DeviceIoControl
EnterCriticalSection
FindVolumeMountPointClose
FormatMessageW
FreeLibrary
GetCommandLineW
GetDateFormatW
GetDiskFreeSpaceExW
GetDriveTypeW
GetExitCodeProcess
GetFileSize
GetLastError
GetLocaleInfoW
GetNumberFormatW
GetStartupInfoW
GetSystemTimeAdjustment
GlobalFree
IsBadReadPtr
LeaveCriticalSection
LoadLibraryW
LocalAlloc
LocalFree
SearchPathW
SetCommBreak
SetCriticalSectionSpinCount
SetLastError
Sleep
SwitchToFiber
WideCharToMultiByte
WriteFile
lstrcatW
lstrcpyW
lstrcpynW
lstrlenW
VirtualAlloc
LoadResource
FindResourceA
CompareStringW
CompareStringA
GetSystemInfo
VirtualProtect
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
IsValidCodePage
IsValidLocale
SetEnvironmentVariableA
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
HeapSize
LoadLibraryA
VirtualQuery
InterlockedExchange
RtlUnwind
InitializeCriticalSection
IsBadWritePtr
HeapReAlloc
GetCPInfo
GetCurrentThreadId
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
TlsAlloc
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
FatalAppExitA
GetACP
GetOEMCP
ole32
IsValidPtrIn
CoDisableCallCancellation
OleTranslateAccelerator
oleaut32
CreateDispTypeInfo
VarR8FromUI4
VectorFromBstr
SafeArrayUnaccessData
rpcrt4
I_RpcTransServerNewConnection
NdrProxySendReceive
user32
PostMessageW
OpenDesktopA
MessageBoxW
LoadStringW
SetCursor
IsWindow
EnumDisplayDevicesA
DestroyWindow
DestroyIcon
AnyPopup
SetDlgItemTextW
SetWindowLongW
SetFocus
WinHelpW
wsprintfW
wvsprintfW
LoadIconW
FindWindowExW
Exports
Exports
Sections
.text Size: 64KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ