Static task
static1
Behavioral task
behavioral1
Sample
a800cf8477b20642e30bdab2b3b938ee_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a800cf8477b20642e30bdab2b3b938ee_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a800cf8477b20642e30bdab2b3b938ee_JaffaCakes118
-
Size
112KB
-
MD5
a800cf8477b20642e30bdab2b3b938ee
-
SHA1
78d024e2f8da37b977a2c4099e6cd942fbebef5a
-
SHA256
c1d26b09354cb7b6d8ddc11cd09a6500a12a15200171f643e302c61c0213b705
-
SHA512
3c2b6fcffd9d21c079302fa96e4ff2a096beb68cdd3a280c65522b1f005b27dc57e71fcc24d4783e6c259d4194a530ad3f38da4928fddad761e76c52c8d88b93
-
SSDEEP
3072:msb1IVLs05WNzmn+OPyEQ1nKXBGfK/a8u4xX9qC0AuD36x:XI20okfarfKYM8BD3K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a800cf8477b20642e30bdab2b3b938ee_JaffaCakes118
Files
-
a800cf8477b20642e30bdab2b3b938ee_JaffaCakes118.dll windows:4 windows x86 arch:x86
06b269f5c00cabf4986f73faefb8d4cb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RaiseException
GlobalFree
ReleaseMutex
WaitForSingleObject
FreeLibrary
GetModuleHandleW
WideCharToMultiByte
lstrlenA
GetVersionExW
InterlockedDecrement
CreateEventW
ChangeTimerQueueTimer
SetCurrentDirectoryW
GetWindowsDirectoryW
CreateDirectoryW
GetComputerNameW
GetCurrentDirectoryW
MoveFileExW
UnregisterWait
LoadLibraryW
GetSystemInfo
DisableThreadLibraryCalls
GetProcAddress
OpenFileMappingW
MapViewOfFileEx
CreateFileMappingW
VirtualAlloc
UnmapViewOfFile
GetModuleFileNameA
GetProfileStringA
CreateFileA
InterlockedIncrement
VirtualProtect
IsDebuggerPresent
GetCommandLineA
user32
CheckDlgButton
IsDlgButtonChecked
ShowWindow
MessageBoxW
SendMessageW
GetParent
PostMessageW
SetWindowLongW
BringWindowToTop
SetForegroundWindow
GetDlgItem
GetWindowLongW
SetCursor
LoadCursorW
SetWindowTextW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
msvcrt
_initterm
_adjust_fdiv
_strcmpi
memcpy
tolower
strchr
_strnicmp
strrchr
__dllonexit
_lock
_onexit
_stricmp
isspace
memset
wcschr
malloc
_except_handler3
_wcsicmp
_amsg_exit
_XcptFilter
free
_callnewh
Sections
.text Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ