Static task
static1
Behavioral task
behavioral1
Sample
b2b0482c7c2c224c7dcda68bf3826186_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b2b0482c7c2c224c7dcda68bf3826186_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b2b0482c7c2c224c7dcda68bf3826186_JaffaCakes118
-
Size
111KB
-
MD5
b2b0482c7c2c224c7dcda68bf3826186
-
SHA1
962fab07b418fefc97cb5a6c6dd29a5fb1e66f01
-
SHA256
29ed66768fe66ded9724ab9432af1013c09308e50ae47ffbc9a03b67e34ad779
-
SHA512
70cb1a5e1900c77dfe31b9b3b05e630224411593330f536bf8d047aa97ac283c8c1fcfd963b44ab46b10807b7fe1cf7326ab180f7ed16c217df598ee3f8d27cc
-
SSDEEP
3072:+bTVEntdVqRqhGBjvOeJI93o6PfiZy+lKkxdM/2GK0FXR6:UWbVMiGBjvjMPfi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b2b0482c7c2c224c7dcda68bf3826186_JaffaCakes118
Files
-
b2b0482c7c2c224c7dcda68bf3826186_JaffaCakes118.dll windows:4 windows x86 arch:x86
2ec2945b64347fc74a6be5ac60a3080d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
InterlockedExchange
InterlockedCompareExchange
GetSystemDirectoryW
GetCommandLineW
GetEnvironmentVariableW
lstrlenW
GetLastError
GetSystemWindowsDirectoryW
CreateFileW
FindFirstFileW
GetTickCount
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CloseHandle
LocalFree
WideCharToMultiByte
FormatMessageW
GetConsoleMode
GetFileType
GetStdHandle
WriteFile
WriteConsoleW
GetConsoleOutputCP
MultiByteToWideChar
ReadConsoleW
LoadLibraryA
FreeLibrary
QueryPerformanceCounter
DisableThreadLibraryCalls
GetModuleFileNameW
LoadLibraryW
GlobalFree
VirtualProtect
GlobalAlloc
FindClose
GetCommandLineA
user32
LoadStringA
GetUserObjectInformationW
GetProcessWindowStation
advapi32
RegCloseKey
EnableTrace
ControlTraceW
TraceMessage
RegOpenKeyExW
RegisterTraceGuidsW
RegQueryValueExW
StartTraceW
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
msvcr71
_wcsicmp
__dllonexit
__CppXcptFilter
_adjust_fdiv
_initterm
malloc
_wcsupr
_except_handler3
wcsrchr
_vsnprintf
exit
_ismbblead
_cexit
memcpy
memmove
free
_onexit
_wcsnicmp
_wcslwr
wcschr
memset
_amsg_exit
_iob
fgets
strchr
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ