Static task
static1
Behavioral task
behavioral1
Sample
a5d8f9f273c0e38c20001ae145cf5fe8_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a5d8f9f273c0e38c20001ae145cf5fe8_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a5d8f9f273c0e38c20001ae145cf5fe8_JaffaCakes118
-
Size
1.0MB
-
MD5
a5d8f9f273c0e38c20001ae145cf5fe8
-
SHA1
39dbbaa772e1376fd1ee9766b6c6dbe24a48a990
-
SHA256
4bed97f110a5ad847fa3fea1be86d4c5356fa1dbf682de734ba706346d67c20c
-
SHA512
9d036d6a291cc66cf6991cad1aaadff6754be2b8de109f5a3cc73648ea21dd7e63cc557ff2dcc2d3da2bf17da7dc70eb3a4da493a88cc090c5cdfd89f4436447
-
SSDEEP
12288:jJJKzUu8UGgJ/Yeln4cmEhdbjzwYRdOvXP+t1N6a:jJMzUy5wet/2uwUXL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a5d8f9f273c0e38c20001ae145cf5fe8_JaffaCakes118
Files
-
a5d8f9f273c0e38c20001ae145cf5fe8_JaffaCakes118.dll windows:4 windows x86 arch:x86
e2cc3563cdf1f344ecb286fccc056630
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateToolhelp32Snapshot
Sleep
lstrcpyA
CopyFileA
GetModuleFileNameA
SizeofResource
LockResource
LoadResource
FindResourceA
LoadLibraryA
SetFileAttributesA
GetLastError
CreateMutexA
Process32First
GetFileAttributesA
HeapAlloc
GetProcessHeap
VirtualAlloc
VirtualProtect
VirtualFree
GetProcAddress
IsBadReadPtr
HeapFree
FreeLibrary
GetStringTypeW
GetStringTypeA
ExitProcess
Process32Next
CreateFileA
WriteFile
CloseHandle
LocalAlloc
LocalReAlloc
GetVersionExA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetOEMCP
GetACP
RtlUnwind
RaiseException
HeapReAlloc
GetCommandLineA
GetVersion
SetUnhandledExceptionFilter
IsBadWritePtr
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
IsBadCodePtr
GetCPInfo
user32
wsprintfA
advapi32
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
shell32
ShellExecuteA
ShellExecuteExA
SHGetSpecialFolderPathA
shlwapi
PathRemoveFileSpecA
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE