Static task
static1
Behavioral task
behavioral1
Sample
b8cb69c2c8144b5e6a9f41bc10b0601a_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b8cb69c2c8144b5e6a9f41bc10b0601a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b8cb69c2c8144b5e6a9f41bc10b0601a_JaffaCakes118
-
Size
172KB
-
MD5
b8cb69c2c8144b5e6a9f41bc10b0601a
-
SHA1
a8179b55574e3940336cd2e70c14c89b4a782d42
-
SHA256
f2253d933b9fe0699955b6441d1b0cf0860c443ebf99a1ff582c28105344c946
-
SHA512
f0fb0acc0b850019f84f258fec64d74ff58375fae60a2e29d43a165a72d047b18afdba634622ff2fa994d269453c7d08e2c70053a6f1c488d90a3c9ac8ed269c
-
SSDEEP
3072:Ygf8VNdQodJQJwDtJCGqQWFMlkqgl5JBy6rGAmACiGHm2plyIIj39vbxb:qVXQoj0L6lqfJBxMg6yIuN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8cb69c2c8144b5e6a9f41bc10b0601a_JaffaCakes118
Files
-
b8cb69c2c8144b5e6a9f41bc10b0601a_JaffaCakes118.dll windows:4 windows x86 arch:x86
2b0194254ca92ccb7f52ea9cde4e36fe
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalLock
GlobalAlloc
HeapWalk
HeapValidate
HeapCompact
GlobalMemoryStatus
GetVersionExW
GetVersionExA
ResetEvent
CreateThread
WaitForMultipleObjects
GlobalSize
FreeLibrary
SetEvent
RemoveDirectoryW
ReadFile
HeapDestroy
HeapCreate
IsDebuggerPresent
OutputDebugStringA
MultiByteToWideChar
WideCharToMultiByte
FlushFileBuffers
GetFileSizeEx
CreateDirectoryW
GlobalUnlock
GetModuleHandleW
GetProcAddress
ExpandEnvironmentStringsA
LoadLibraryA
CopyFileW
MoveFileW
MoveFileExW
GetLogicalDriveStringsW
GetLogicalDrives
GetDriveTypeW
DuplicateHandle
SetFileAttributesW
GetShortPathNameW
CreateProcessW
CreateProcessA
OpenProcess
GetVolumeInformationW
SetFileTime
SetEndOfFile
OpenEventW
GetComputerNameW
GetOverlappedResult
GetFileType
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
GetPrivateProfileStringW
LoadLibraryW
GetExitCodeProcess
GetLocaleInfoW
VirtualAlloc
VirtualFree
DeviceIoControl
DebugBreak
GlobalFree
HeapSize
lstrlenW
lstrcmpiW
WritePrivateProfileStringW
GetCommandLineW
LocalFree
GetLastError
CreateEventW
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
LocalAlloc
ExpandEnvironmentStringsW
GetFileAttributesW
SetErrorMode
GetFullPathNameW
FindClose
FindNextFileW
FindFirstFileW
GetWindowsDirectoryW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetProcessHeap
HeapFree
VirtualQuery
MapViewOfFile
CreateFileMappingW
GetFileSize
UnmapViewOfFile
TlsAlloc
GetLocalTime
TlsSetValue
HeapReAlloc
HeapAlloc
TlsGetValue
GetTempFileNameW
GetTempPathW
SetLastError
FormatMessageW
RaiseException
ExitProcess
TlsFree
GetWindowsDirectoryA
CloseHandle
GetCurrentThread
ReleaseMutex
WaitForSingleObject
SetFilePointer
WriteFile
GetModuleFileNameA
CreateMutexW
CreateFileW
GetModuleFileNameW
DeleteFileW
GetVersion
GetSystemInfo
CreateMutexA
CreateFileMappingA
CreateFileA
DeleteFileA
ole32
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoInitialize
CoCreateGuid
GetHGlobalFromStream
CoInitializeEx
CreateStreamOnHGlobal
shlwapi
PathAppendW
ord158
StrChrW
StrCmpW
dbghelp
MiniDumpWriteDump
oleaut32
VariantTimeToSystemTime
VariantClear
SystemTimeToVariantTime
Sections
.text Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss2 Size: - Virtual size: 112KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ