Static task
static1
Behavioral task
behavioral1
Sample
adf80c1433b780fb5e8d55138c58d178_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
adf80c1433b780fb5e8d55138c58d178_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
adf80c1433b780fb5e8d55138c58d178_JaffaCakes118
-
Size
396KB
-
MD5
adf80c1433b780fb5e8d55138c58d178
-
SHA1
1edf4b827b91875b9566babb10e1a250203f7a16
-
SHA256
f37595484c9c9b2c27176992e36d67c59c6aff5ab79415aba745f773be355ab3
-
SHA512
f3fbc83fb80a934042461df4073fe45f4bd50d9f4c0c1a15428223d5934c8e0fd5ec0ad5a8e79b6e9573235f0c0ec82df0130066d118ba795f3382c8263a2380
-
SSDEEP
6144:o2D+Rw6y2BXsboxYOtYToOgEtygLjfkI5dDNp:H80myOO7vkIP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource adf80c1433b780fb5e8d55138c58d178_JaffaCakes118
Files
-
adf80c1433b780fb5e8d55138c58d178_JaffaCakes118.dll windows:4 windows x86 arch:x86
f572f211420df67e49e54734ff325754
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ddimage
?to_float@Writer@Image@DD@@IAEXHPAMPBM1HH@Z
?inputnget@Write@Image@DD@@QAEXHHHHABVChannelSet@23@AAVRow@23@@Z
?aborted@Op@Image@DD@@QBE_NXZ
??1Row@Image@DD@@QAE@XZ
??0Row@Image@DD@@QAE@HH@Z
?request@Iop@Image@DD@@QAEXHHHHABVChannelSet@23@H@Z
?input@Op@Image@DD@@QBEPAV123@H@Z
?createFileHash@Writer@Image@DD@@IAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?depth@Write@Image@DD@@QBEHXZ
?error@Op@Image@DD@@QAAXPBDZZ
?_next@ChannelSet@Image@DD@@ABE?AW4Channel@23@W4423@@Z
?SetFlags@Image@DD@@YAXAAVKnob_Closure@12@H@Z
?SetRange@Image@DD@@YAXAAVKnob_Closure@12@NN@Z
?Tooltip@Image@DD@@YAXAAVKnob_Closure@12@PBD@Z
?knob@Op@Image@DD@@QBEPAVKnob@23@PBD@Z
?ctor2@Description@Image@DD@@AAEXP6AXPAV123@@Z@Z
?add@Description@Writer@Image@DD@@CAXPAV134@@Z
?getLut@LUT@Image@DD@@SAPAV123@W4DataType@123@@Z
?abi6_0_1@Writer@Image@DD@@EAEHXZ
?split_input@Writer@Image@DD@@MBEHH@Z
?inputContext@Writer@Image@DD@@MBEABVOutputContext@23@HAAV423@@Z
?progressFraction@Op@Image@DD@@QAEXN@Z
??1Writer@Image@DD@@UAE@XZ
??0Writer@Image@DD@@QAE@PAVWrite@12@@Z
?renameFromHash@Writer@Image@DD@@IAEXXZ
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
msvcp80
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??_7ios_base@std@@6B@
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??_8?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_Init@locale@std@@CAPAV_Locimp@12@XZ
?id@?$ctype@D@std@@2V0locale@2@A
??_7ctype_base@std@@6B@
_Getctype
??_7?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@
??_7?$basic_streambuf@DU?$char_traits@D@std@@@std@@6B@
??0_Mutex@std@@QAE@XZ
??1_Mutex@std@@QAE@XZ
??_7?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
?id@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
??_7?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
?uncaught_exception@std@@YA_NXZ
?_Unlock@_Mutex@std@@QAEXXZ
??_7?$ctype@D@std@@6B@
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xlen@_String_base@std@@SAXXZ
?_Id_cnt@id@locale@std@@0HA
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??_7facet@locale@std@@6B@
??_7?$numpunct@D@std@@6B@
_Getcvt
?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z
?facet_Register@facet@locale@std@@CAXPAV123@@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
_Toupper
_Tolower
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@_String_base@std@@SAXXZ
msvcr80
_access
strncpy
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_purecall
floor
_wrename
_wremove
remove
printf
qsort
?what@exception@std@@UBEPBDXZ
_stricmp
free
??0exception@std@@QAE@XZ
strcspn
memchr
sprintf_s
??_V@YAXPAX@Z
localeconv
_invalid_parameter_noinfo
memset
??3@YAXPAX@Z
_CxxThrowException
??0exception@std@@QAE@ABQBD@Z
memcpy_s
memmove_s
__CxxFrameHandler
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
malloc
??2@YAPAXI@Z
_strdup
kernel32
MultiByteToWideChar
LoadLibraryA
GetLastError
GlobalFree
GlobalAlloc
FreeLibrary
GetModuleFileNameA
GetProcAddress
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetCurrentProcessId
GetSystemDirectoryA
GetModuleHandleA
InterlockedExchange
Sleep
InterlockedCompareExchange
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentDirectoryA
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
user32
wsprintfA
Sections
.text Size: 168KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text1 Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 64KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ