rasCommonVdm
Static task
static1
Behavioral task
behavioral1
Sample
a5c03d756c9f1199014e079a46c68a21_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a5c03d756c9f1199014e079a46c68a21_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a5c03d756c9f1199014e079a46c68a21_JaffaCakes118
-
Size
152KB
-
MD5
a5c03d756c9f1199014e079a46c68a21
-
SHA1
c2176c4eeb10da7b2c107ea7141179e87d6e370e
-
SHA256
ffd10847651a8ed27db41edd300918f1d4e0689dde1253bb5e183ddd415749ee
-
SHA512
fed92372577383d8730f245d7fa8bd43dd24a34f1ac2d569b68689d402f75bc1a83d91d0bca9f8243655c041161575b824b783843ed729bb7dd2d6aa105ba294
-
SSDEEP
3072:Bgei2XfIRKqoJktCk1T521s7LpebOmDK4dmjveiU9bsLlhMMNk:BgfueCk1T521simqnAL7MM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a5c03d756c9f1199014e079a46c68a21_JaffaCakes118
Files
-
a5c03d756c9f1199014e079a46c68a21_JaffaCakes118.dll windows:4 windows x86 arch:x86
13b35bf359b2c00ba1ecf103cf0d6823
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalFree
LocalFree
CreateDirectoryA
Sleep
GetComputerNameA
WriteProcessMemory
TerminateProcess
WriteFile
GetTickCount
OpenFileMappingA
GlobalAlloc
CreateEventA
CreateFileMappingA
ReadProcessMemory
UnmapViewOfFile
CreateMutexW
LoadLibraryA
CopyFileA
GetVolumeInformationA
WaitForSingleObject
HeapAlloc
GetCurrentProcess
HeapFree
CreateFileA
ExitProcess
SetLastError
InterlockedIncrement
CloseHandle
EnterCriticalSection
CreateProcessA
GetProcessHeap
GetCommandLineA
GetModuleHandleA
GetLastError
LeaveCriticalSection
MapViewOfFile
GetProcAddress
GetModuleFileNameA
InterlockedDecrement
InterlockedCompareExchange
OpenEventA
ole32
OleSetContainedObject
CoUninitialize
CoSetProxyBlanket
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoCreateGuid
OleCreate
user32
SetWindowsHookExA
GetParent
ClientToScreen
SetWindowLongA
CreateWindowExA
SendMessageA
DispatchMessageA
TranslateMessage
DefWindowProcA
UnhookWindowsHookEx
GetMessageA
RegisterWindowMessageA
PeekMessageA
FindWindowA
GetClassNameA
GetWindow
KillTimer
PostQuitMessage
SetTimer
GetWindowThreadProcessId
GetSystemMetrics
ScreenToClient
GetWindowLongA
GetCursorPos
DestroyWindow
oleaut32
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
shlwapi
StrStrIW
UrlUnescapeW
advapi32
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
SetTokenInformation
OpenProcessToken
RegQueryValueExA
GetUserNameA
RegDeleteKeyA
DuplicateTokenEx
RegCloseKey
shell32
SHGetFolderPathA
Exports
Exports
Sections
.text Size: 120KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ntszs Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ