RunDllEntry
Static task
static1
Behavioral task
behavioral1
Sample
b61d0080133fe0910048cf811ed7d049_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b61d0080133fe0910048cf811ed7d049_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b61d0080133fe0910048cf811ed7d049_JaffaCakes118
-
Size
448KB
-
MD5
b61d0080133fe0910048cf811ed7d049
-
SHA1
6cc50db17e0e80dad6f392f0b99f211965b84939
-
SHA256
101e70a5455212b40406fe70361995a3a346264eabd4029200356565d2bacd6a
-
SHA512
d3759243a86a38e4fee87b98b2082eca10b851e04698eec3ee37a1a2ff3501768f6870231cbc5e341eba1537e16ccad46f4f2392cbc34bf795ccfdead658a103
-
SSDEEP
12288:OuHxZKqBaUMqzwtQ3ZB3sKSd/Cf6hoHvg:OuRZKqBaUJw0B3sKSd/M6hoPg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b61d0080133fe0910048cf811ed7d049_JaffaCakes118
Files
-
b61d0080133fe0910048cf811ed7d049_JaffaCakes118.dll windows:5 windows x86 arch:x86
866eabd69b701223a7065f94bac05d08
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
TerminateThread
ResumeThread
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameW
FindResourceW
SizeofResource
LoadResource
LockResource
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CopyFileW
GetEnvironmentVariableW
GetTempFileNameW
GetSystemDirectoryW
OpenProcess
TerminateProcess
CloseHandle
WaitNamedPipeW
CreateNamedPipeW
ConnectNamedPipe
CreateFileW
ReadFile
WriteFile
FormatMessageA
LocalFree
FindFirstFileExW
FindClose
FindNextFileW
FreeLibrary
LoadLibraryW
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
HeapFree
WaitForSingleObject
HeapAlloc
RaiseException
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
DeleteFileW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointer
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapSize
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetModuleHandleA
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
GetTimeZoneInformation
SetEndOfFile
GetProcessHeap
CompareStringA
CompareStringW
SetEnvironmentVariableA
FindFirstFileW
AreFileApisANSI
ExitProcess
GetVersion
GetStringTypeW
GetSystemTime
CreateThread
GetSystemTimeAsFileTime
Sleep
CreateRemoteThread
wininet
InternetSetOptionW
InternetCloseHandle
HttpQueryInfoW
InternetReadFile
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetOpenW
InternetErrorDlg
crypt32
CryptStringToBinaryA
CryptBinaryToStringA
user32
PostMessageW
PeekMessageW
CreateWindowExW
RegisterClassExW
DefWindowProcW
GetParent
DispatchMessageW
DestroyWindow
advapi32
RegCreateKeyExW
RegQueryValueExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegCloseKey
shell32
SHGetFolderPathW
ole32
CoUninitialize
CoInitializeEx
CoCreateGuid
Exports
Exports
Sections
.text Size: 316KB - Virtual size: 316KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ