Static task
static1
Behavioral task
behavioral1
Sample
94e8fac5bfe8f166f272f8b2f3a40690_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
94e8fac5bfe8f166f272f8b2f3a40690_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
94e8fac5bfe8f166f272f8b2f3a40690_JaffaCakes118
-
Size
136KB
-
MD5
94e8fac5bfe8f166f272f8b2f3a40690
-
SHA1
43696090078cf046ed18483598e6e5dd28ad4d3c
-
SHA256
9b6dd98d796038f8d674015f4d57d39803af4413a29e6dada30b672b9f5f2227
-
SHA512
caa276b952191a0ba3557453dcb5f6dfddcc37f6b8dbbcd5713263f9081ccd001bd997e9a4468d446c028e0105bb036f159a790a37cfcd1e91cf5b60e0459f7a
-
SSDEEP
3072:nuKfhiV4RNHgIwt3Lu29UJeIAwsWl8hKvqdHodDmOIow9W5vQ+:nuKfhiV4RKn9Ld9VbwsBcaRzavQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 94e8fac5bfe8f166f272f8b2f3a40690_JaffaCakes118
Files
-
94e8fac5bfe8f166f272f8b2f3a40690_JaffaCakes118.dll windows:4 windows x86 arch:x86
537cb4a4d066d98c57e747051f5b133f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetOverlappedResult
DeviceIoControl
InterlockedIncrement
WideCharToMultiByte
WaitForMultipleObjectsEx
SetThreadPriority
ResumeThread
CreateEventA
GetProcAddress
ReleaseMutex
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateMutexW
RegisterWaitForSingleObject
SwitchToThread
CreateIoCompletionPort
PostQueuedCompletionStatus
DuplicateHandle
GetQueuedCompletionStatus
LocalFree
GetSystemInfo
InterlockedDecrement
GetSystemTimeAsFileTime
LoadLibraryExW
FindResourceW
LoadResource
GetModuleFileNameW
SizeofResource
lstrcmpiW
GetModuleHandleW
CancelIo
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
HeapSize
GetCPInfo
GetOEMCP
GetACP
GetEnvironmentStringsW
GetLastError
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetLocaleInfoA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ExitProcess
VirtualQuery
HeapReAlloc
HeapCreate
HeapDestroy
GetModuleHandleA
LoadLibraryA
FreeLibrary
DisableThreadLibraryCalls
WaitForSingleObject
Sleep
GetTickCount
InitializeCriticalSectionAndSpinCount
LocalAlloc
SetEvent
CreateEventW
GlobalMemoryStatus
VirtualAlloc
VirtualFree
CloseHandle
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InterlockedExchange
ResetEvent
GetCommandLineA
lstrlenW
VirtualProtect
GetVersionExA
RtlUnwind
HeapFree
HeapAlloc
user32
SendMessageA
GetDlgItem
GetMessageA
DispatchMessageA
GetParent
GetWindowLongA
SetWindowLongW
GetDC
ReleaseDC
SendMessageW
SendDlgItemMessageW
MessageBoxW
SetTimer
CharNextW
InvalidateRect
SystemParametersInfoW
wsprintfW
MoveWindow
LoadStringA
MessageBoxA
ShowWindow
GetClientRect
GetWindowRect
SetWindowTextA
wsprintfA
EnableWindow
IsWindowEnabled
WinHelpA
SetWindowLongA
advapi32
InitializeAcl
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegSetValueExW
GetLengthSid
InitializeSecurityDescriptor
RegOpenKeyExW
RegQueryValueExW
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
gdi32
CreatePen
GetTextMetricsW
DeleteObject
SelectObject
SetBkMode
CreateDIBSection
ole32
CoUninitialize
CoInitialize
CLSIDFromProgID
CoTaskMemFree
CoCreateInstance
Sections
.text Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ