CreateInstance
Static task
static1
Behavioral task
behavioral1
Sample
aa09f39e0490d2a76906e08d0199549f_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
aa09f39e0490d2a76906e08d0199549f_JaffaCakes118
-
Size
184KB
-
MD5
aa09f39e0490d2a76906e08d0199549f
-
SHA1
d6e9944aaad0f0327ffaad6fe49d78be8b902976
-
SHA256
e3566a33184c1077323dc4e38a8ab1eb0170c5366e2a24d54580d0c256f4b969
-
SHA512
699b4cf0a3dd4f28868295794c3ad709b7b5a77fc15ebbd0a8374c372ab9f9a63d04c5ef8799d4818c4319218c86c6ff8093a135ebfeac286f28e77971e23736
-
SSDEEP
3072:hsfRXCiEK23eslHxi7OcPnUlu5BAnViPUXAXmotd+Q:GQHK23Z/cPnUl8B0VPY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa09f39e0490d2a76906e08d0199549f_JaffaCakes118
Files
-
aa09f39e0490d2a76906e08d0199549f_JaffaCakes118.dll windows:4 windows x86 arch:x86
8a886c254addaa951e1609294f388214
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
winmm
mciSendCommandA
kernel32
InterlockedDecrement
FreeLibrary
GetProcAddress
InterlockedIncrement
Sleep
GetDriveTypeA
DeviceIoControl
CreateFileA
WaitForSingleObject
CreateEventA
SetErrorMode
GetVersionExA
CloseHandle
LoadLibraryA
LeaveCriticalSection
IsBadWritePtr
WideCharToMultiByte
HeapReAlloc
RaiseException
GetOEMCP
RtlUnwind
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetStringTypeW
GetACP
MultiByteToWideChar
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetStringTypeA
user32
wsprintfA
advapi32
RegEnumKeyA
RegQueryValueExA
RegCloseKey
RegQueryInfoKeyA
RegOpenKeyExA
oleaut32
SafeArrayDestroy
Exports
Exports
Sections
.text Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE