Static task
static1
Behavioral task
behavioral1
Sample
a0ccb97275c5238dcfbf0582d85839f0_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a0ccb97275c5238dcfbf0582d85839f0_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a0ccb97275c5238dcfbf0582d85839f0_JaffaCakes118
-
Size
150KB
-
MD5
a0ccb97275c5238dcfbf0582d85839f0
-
SHA1
91348f621ace9abf92bbb288a4421609ee7905b2
-
SHA256
40ee72b872fa42d0e8a5fb358ee67d8f450a5808a9b687d85d56fb5664e5cd81
-
SHA512
1b6694c4e69836857cbf98eaf32c89f863d5ddafa36335943ae62cfed570147fe49f2a12ad9fd861c302929e5fc96b5de93fab25ee0fcd468bc45b0fc8979746
-
SSDEEP
3072:Lnr1502pZIGYcnBRbNYyKvFDBxa3bNasxnoXsFZQxG2OFw9JoRyop+VuAwoyxMm:Tr1tpZIXaTKD3ka2weSZOFeo6uAK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0ccb97275c5238dcfbf0582d85839f0_JaffaCakes118
Files
-
a0ccb97275c5238dcfbf0582d85839f0_JaffaCakes118.dll windows:4 windows x86 arch:x86
ce28ff9b576e4fdd7ebfe7413c33bfe0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExpandEnvironmentStringsW
lstrcatW
SetFileAttributesW
lstrcmpiW
CopyFileW
lstrcpynW
GetProcessHeap
RegisterWaitForSingleObject
InterlockedDecrement
SetEvent
ResetEvent
CreateEventW
SetFilePointer
GetTempFileNameW
GetVolumeNameForVolumeMountPointW
WriteFile
FlushFileBuffers
ReadFile
ReleaseMutex
CreateFileW
CreateMutexW
RemoveDirectoryW
MoveFileW
GetVolumeInformationW
GetSystemDirectoryW
LoadLibraryExW
FormatMessageW
DeleteFileW
LocalAlloc
LocalFree
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
GetOEMCP
GetStringTypeW
GetACP
GetDriveTypeW
GetDiskFreeSpaceExW
GetSystemTimeAsFileTime
QueueUserWorkItem
FreeLibrary
LoadLibraryW
lstrcpyW
lstrlenW
GetCurrentThreadId
GetFileAttributesW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FindFirstFileW
lstrcmpW
HeapDestroy
QueryDosDeviceW
CreateDirectoryW
FindNextFileW
FindClose
lstrlenA
lstrcatA
lstrcpyA
CreateProcessA
CreateDirectoryA
GetSystemDirectoryA
GetSystemInfo
WaitForSingleObject
CloseHandle
GetVolumeInformationA
GetCommandLineA
OpenMutexW
VirtualProtect
GetCPInfo
HeapReAlloc
RtlUnwind
GetVersion
ExitProcess
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapAlloc
VirtualAlloc
user32
GetSystemMetrics
LoadBitmapA
GetKeyboardType
LoadStringW
CharUpperW
wsprintfW
GetSysColor
MessageBoxA
advapi32
RegisterEventSourceW
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyW
RegDeleteValueW
RegSetValueExW
CloseServiceHandle
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
LsaClose
LsaQueryInformationPolicy
SetSecurityInfo
SetEntriesInAclW
AllocateAndInitializeSid
EqualSid
GetAce
GetAclInformation
RegCreateKeyExW
SetThreadToken
RegDeleteKeyW
RegUnLoadKeyW
RegEnumValueW
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegQueryInfoKeyA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
DeregisterEventSource
ole32
CoUninitialize
CoTaskMemFree
Sections
.text Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ