CreateDatabaseSession
Static task
static1
Behavioral task
behavioral1
Sample
b33e8d2ec204a2f1b7dc241aa10d54ec_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b33e8d2ec204a2f1b7dc241aa10d54ec_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b33e8d2ec204a2f1b7dc241aa10d54ec_JaffaCakes118
-
Size
64KB
-
MD5
b33e8d2ec204a2f1b7dc241aa10d54ec
-
SHA1
a00f7883b3fc694e6150e77a2ed4d1d0f45db6c5
-
SHA256
c0db0a67841681d032d9762e49d3b18f9dc70773184ac99280f2b86485a94f88
-
SHA512
db41d3cdebb9317b2c4f366693ecfc2055c66da4ac20e1dfa86ad1942f9a2637d113878ec67b07a258ea2acbb57959718d692d6ca3a9cc0e659a255f7034ff70
-
SSDEEP
768:WhC5KrwxvJgY7Fy+HthXdTavyAcQR5q9qfe59b0ou1mzeug61wk3lMaKJNIsWd:Z00r7Fy+HthNu1ytLJzu61wk3lUfIxd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b33e8d2ec204a2f1b7dc241aa10d54ec_JaffaCakes118
Files
-
b33e8d2ec204a2f1b7dc241aa10d54ec_JaffaCakes118.dll windows:5 windows x86 arch:x86
2bfec0b356a144bdcd6750da1f089ffa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_BIND
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msnmetal
ord132
ord137
ord135
ord154
ord151
ord147
ord126
ord107
ord128
ord142
ord130
ord3
ord152
ord119
ord111
ord112
ord113
ord37
ord133
ord4
ord131
ord127
ord153
kernel32
CompareFileTime
MulDiv
CreateThread
CloseHandle
IsDBCSLeadByte
GetStringTypeExA
LocalReAlloc
LocalAlloc
lstrcmpA
DeleteCriticalSection
DisableThreadLibraryCalls
GetSystemInfo
InitializeCriticalSection
InterlockedIncrement
InterlockedDecrement
LeaveCriticalSection
WaitForSingleObject
lstrcmpiA
GetCurrentThreadId
EnterCriticalSection
SetEvent
GetCurrentProcessId
ReleaseMutex
HeapDestroy
HeapFree
UnmapViewOfFile
HeapCreate
FlushViewOfFile
HeapAlloc
lstrlenA
MapViewOfFile
GetLastError
SetEndOfFile
SetFilePointer
Sleep
lstrlenW
CreateFileMappingA
OpenFileMappingA
GetFileSize
GetDiskFreeSpaceA
WideCharToMultiByte
ole32
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
user32
CharUpperA
DestroyWindow
IsWindow
TranslateMessage
shlwapi
StrCmpW
StrStrA
StrStrIA
StrToIntExA
wnsprintfW
PathRenameExtensionW
PathFileExistsW
StrCmpIW
StrCpyNW
Exports
Exports
Sections
.text Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE