Static task
static1
Behavioral task
behavioral1
Sample
abc334ab75606ca538ac3541c9ecc242_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
abc334ab75606ca538ac3541c9ecc242_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
abc334ab75606ca538ac3541c9ecc242_JaffaCakes118
-
Size
97KB
-
MD5
abc334ab75606ca538ac3541c9ecc242
-
SHA1
992206c8bb63e4427816940bf9dd4a12aa4595e6
-
SHA256
fc1318dd6a7ba5593e45ea0d7b130c764d795361686e70712183416eaaf8a7ce
-
SHA512
1770ffebb0b8ef60fd7a9e78c941cb61846e681f0e82d87de47a3eb95da0a53f47aa3eef7dcf2ac56e9d95da0b037d3752626791511cf9897c358ab90c546ae1
-
SSDEEP
1536:5wkSv7qAOqMfZIYstdPxSrJkJ65SY2QmPKWk7m657OBN5btxw6qV+57+38vs:VSveASIBPxSrJk3ma+aDJU+xa8vs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource abc334ab75606ca538ac3541c9ecc242_JaffaCakes118
Files
-
abc334ab75606ca538ac3541c9ecc242_JaffaCakes118.dll windows:4 windows x86 arch:x86
bcd13ecc8ef74e716518c139573882af
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
TlsGetValue
GetLocalTime
CreateDirectoryW
CopyFileW
ExitThread
ExpandEnvironmentStringsW
LoadLibraryA
TlsSetValue
CreateEventW
SetEnvironmentVariableW
GetModuleHandleW
CloseHandle
GetLastError
SetLastError
InterlockedExchange
CreateFileW
VirtualProtect
VirtualAlloc
WriteFile
FreeLibrary
GetComputerNameW
GetProcAddress
LocalAlloc
FormatMessageW
RaiseException
LeaveCriticalSection
EnterCriticalSection
GetVersion
GetCommandLineA
GetTickCount
LocalFree
advapi32
LsaOpenPolicy
LsaClose
CryptReleaseContext
CryptDestroyKey
CryptGenRandom
GetLengthSid
RevertToSelf
RegCloseKey
RegOpenKeyExW
CryptAcquireContextW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
LsaQueryInformationPolicy
ImpersonateLoggedOnUser
RegCreateKeyW
rpcrt4
RpcStringFreeW
msvcrt
wcscat
__CxxFrameHandler
_except_handler3
wcsstr
vsprintf
wcschr
_wcsnicmp
_wcsicmp
sprintf
swprintf
wcslen
wcscpy
free
_initterm
malloc
_adjust_fdiv
Sections
.text Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ