DevPathARM
Static task
static1
Behavioral task
behavioral1
Sample
b2478acfc4455fca3f04ab0800f97d9d_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b2478acfc4455fca3f04ab0800f97d9d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b2478acfc4455fca3f04ab0800f97d9d_JaffaCakes118
-
Size
84KB
-
MD5
b2478acfc4455fca3f04ab0800f97d9d
-
SHA1
315399faac60cb0a6fbaab7c43fa5441244d2bc2
-
SHA256
8b1f6d52473066f6456016fb5d59b02720f697d98e8aadec752401562f0e5211
-
SHA512
b71084a6c8a11e692740fc50e8c20b281caa4e640d9fa159ac22af00eed32154a0a8e016dd985650ac9f4766bb0c5a11b8bb1f49679645c93cef1f3814d1d1d8
-
SSDEEP
1536:O6DWBL525MVZb1+aQlyRT9acHlDoQODY6Vx4W4f3k44M2Q16OOIDRnUgWKk:O6DWBI5MLb1SlyRT9BDoQOks4WQ3kVMY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b2478acfc4455fca3f04ab0800f97d9d_JaffaCakes118
Files
-
b2478acfc4455fca3f04ab0800f97d9d_JaffaCakes118.dll windows:4 windows x86 arch:x86
f5dfc6996aab56918c39f0f6c10a59d5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
VirtualQuery
WaitForSingleObject
GetProcAddress
GetLastError
ReleaseMutex
GetSystemDirectoryA
EnterCriticalSection
CloseHandle
InterlockedIncrement
HeapAlloc
SetLastError
Sleep
lstrlenW
LoadLibraryA
GetModuleFileNameA
WriteFile
CreateDirectoryA
UnmapViewOfFile
InterlockedExchange
lstrlenA
MapViewOfFile
GetCalendarInfoW
PeekNamedPipe
FindFirstFileA
SetMailslotInfo
WriteFileEx
GetCurrentThreadId
SetWaitableTimer
GlobalReAlloc
IsBadStringPtrW
SetErrorMode
GetHandleInformation
SearchPathA
CreateToolhelp32Snapshot
UnlockFileEx
FindResourceA
FillConsoleOutputCharacterW
TransactNamedPipe
WaitForMultipleObjectsEx
SystemTimeToTzSpecificLocalTime
RegisterWaitForSingleObjectEx
QueryPerformanceFrequency
GlobalFindAtomW
SetComputerNameA
EscapeCommFunction
SetCommBreak
GetComputerNameExW
SetupComm
GetConsoleCP
FileTimeToSystemTime
OpenSemaphoreA
GetTimeFormatA
GlobalAddAtomA
GetProcessAffinityMask
GetAtomNameA
IsValidCodePage
GetNumberFormatA
CreateJobObjectW
GetCommMask
LoadResource
RemoveDirectoryA
CreateWaitableTimerW
IsValidLanguageGroup
GetBinaryTypeA
EndUpdateResourceA
GetTimeZoneInformation
VirtualUnlock
BackupWrite
WriteProfileStringW
GetCommConfig
GetUserDefaultLangID
oleaut32
SysReAllocStringLen
Exports
Exports
Sections
.text Size: 64KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ