Static task
static1
Behavioral task
behavioral1
Sample
b80638eeaec10931648fb79c0e4adbcb_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b80638eeaec10931648fb79c0e4adbcb_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b80638eeaec10931648fb79c0e4adbcb_JaffaCakes118
-
Size
122KB
-
MD5
b80638eeaec10931648fb79c0e4adbcb
-
SHA1
cdcf06b96d0cef96e3bc7b1b4aa17dec79a84d1c
-
SHA256
d4db3958e4eced01fa492e079f0f1dfa31ee720284a4fa9a8513aca9556bf53d
-
SHA512
9e5a5c9bd50d143bb02caa56f11e0193b88b1b9d64927bfa7c8fdbdff85389f046fc1a434e22c36df7d2dde01f3ffe6bc01a366b85545f4ca9388cdc11077c4a
-
SSDEEP
3072:PHA8LhGgyxkzhYuEx3mRzfJjK/YncCWe7:/A8LhG6NYuExiphcCWe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b80638eeaec10931648fb79c0e4adbcb_JaffaCakes118
Files
-
b80638eeaec10931648fb79c0e4adbcb_JaffaCakes118.dll windows:4 windows x86 arch:x86
7ca2267e09ba5d34e39cec60c6de3a4a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
lstrcmpiW
VirtualUnlock
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentDirectoryW
SearchPathW
SetCurrentDirectoryW
GetFullPathNameA
GetFullPathNameW
CreateFileA
DisableThreadLibraryCalls
GetTickCount
FindResourceW
LoadResource
SizeofResource
lstrlenA
lstrcpynW
Sleep
GetCommandLineW
GetProcessHeap
OutputDebugStringA
FreeLibrary
GetProcAddress
GetSystemDirectoryW
LoadLibraryW
GetFileAttributesW
LoadLibraryExW
GetModuleFileNameW
GetACP
CloseHandle
InterlockedExchange
CreateFileW
MultiByteToWideChar
GetLocaleInfoW
LocalFree
MulDiv
lstrlenW
GetCommandLineA
ExitProcess
FormatMessageW
LocalAlloc
VirtualProtect
WideCharToMultiByte
user32
GetMessageW
LoadAcceleratorsW
MessageBoxW
GetDesktopWindow
CreateWindowExW
CharNextW
PostQuitMessage
DestroyWindow
TranslateMessage
EndPaint
GetClientRect
BeginPaint
SendMessageW
DefWindowProcW
EnableWindow
InvalidateRect
MessageBeep
GetSysColorBrush
DispatchMessageW
LoadIconW
SetRect
ScrollWindowEx
SetScrollInfo
RegisterClassW
LoadCursorW
PostMessageW
SetCursor
SetWindowPos
DrawTextW
GetSystemMetrics
LoadStringW
PostThreadMessageW
TranslateAcceleratorW
advapi32
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
InitializeAcl
AddAce
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
IsValidSecurityDescriptor
RegCloseKey
RegSetValueExW
SetSecurityDescriptorDacl
gdi32
OffsetRgn
StartDocW
StartPage
EndPage
EndDoc
SetTextAlign
GetTextExtentPoint32W
GetTextMetricsW
MoveToEx
LineTo
AddFontResourceW
GetFontResourceInfoW
GetFontData
GetDeviceCaps
DeleteDC
DeleteObject
GetTextCharsetInfo
SelectObject
CreateFontIndirectW
TranslateCharsetInfo
CreateCompatibleDC
GetStockObject
CombineRgn
ExtCreateRegion
CreateRectRgn
RemoveFontResourceW
ole32
CoTaskMemAlloc
CoRegisterPSClsid
CoRegisterClassObject
CoInitializeSecurity
CoUninitialize
CoTaskMemFree
msvcrt
realloc
_isatty
__CxxFrameHandler
_errno
wcsrchr
_wcsnicmp
wcsncmp
_CxxThrowException
mbtowc
__mb_cur_max
_iob
ferror
__badioinfo
__pioinfo
_fileno
_lseeki64
_write
_cexit
_ismbblead
exit
_acmdln
_initterm
_amsg_exit
memset
wcstoul
_vsnwprintf
_except_handler3
free
malloc
wcslen
rand
_wcsicmp
_adjust_fdiv
srand
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ