Static task
static1
Behavioral task
behavioral1
Sample
8e4a9202db74f35c37fe94bf9e78bb53_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8e4a9202db74f35c37fe94bf9e78bb53_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8e4a9202db74f35c37fe94bf9e78bb53_JaffaCakes118
-
Size
184KB
-
MD5
8e4a9202db74f35c37fe94bf9e78bb53
-
SHA1
dced4df2059f696cb8b2bdee8278627b408cae02
-
SHA256
90c4a250556c7cb6f61647e3ed7b7634a20a09f208e425f887d811023b1d8e7c
-
SHA512
f0155e7ea783f0b29db28aac265125b49805936b92448499e670d0d509762df82b51cf8552a34e52852a4104880749b9504dde8a968a7474dff959a6fb90c593
-
SSDEEP
3072:zPHlfsBkMvW4+w0ox1ZwVfUkiEujfJSgdjtu/x3Ys6jkcwYbJACqZlDyln5I1LDX:jHlfaTh581B6jkcRVwq5IZcw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e4a9202db74f35c37fe94bf9e78bb53_JaffaCakes118
Files
-
8e4a9202db74f35c37fe94bf9e78bb53_JaffaCakes118.dll windows:4 windows x86 arch:x86
45a936399add008d1ea5ec383f34dd6c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedIncrement
GetProcessHeap
CreateFileA
LocalFree
LocalAlloc
MultiByteToWideChar
InterlockedExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrlenW
WideCharToMultiByte
GetLocalTime
GlobalLock
LoadLibraryW
CloseHandle
SetEvent
ResetEvent
InterlockedDecrement
CreateThread
Sleep
ReleaseMutex
WaitForSingleObject
UnregisterWaitEx
CancelWaitableTimer
SetWaitableTimer
CreateEventA
ResumeThread
CreateWaitableTimerW
LoadLibraryA
GetProcAddress
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
HeapSize
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
VirtualProtect
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetCommandLineA
DuplicateHandle
HeapReAlloc
VirtualAlloc
GetCPInfo
GetOEMCP
GetACP
HeapAlloc
GetEnvironmentStringsW
GetLastError
RtlUnwind
GetVersionExA
VirtualQuery
ExitProcess
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetSystemInfo
user32
DispatchMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage
PeekMessageW
PostThreadMessageW
advapi32
RegQueryValueExA
StartServiceA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegCloseKey
RegOpenKeyExA
CloseServiceHandle
ole32
CoTaskMemFree
rpcrt4
NdrClientCall2
RpcBindingFree
RpcStringFreeA
RpcBindingFromStringBindingA
RpcStringBindingComposeA
RpcRaiseException
UuidCreate
Sections
.text Size: 132KB - Virtual size: 130KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ