Static task
static1
Behavioral task
behavioral1
Sample
b8f1aa4f9e843bc3528ac3c04cf86cf5_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b8f1aa4f9e843bc3528ac3c04cf86cf5_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b8f1aa4f9e843bc3528ac3c04cf86cf5_JaffaCakes118
-
Size
180KB
-
MD5
b8f1aa4f9e843bc3528ac3c04cf86cf5
-
SHA1
d07de28aeee82a8124428c66e8e794f2cc0ad84e
-
SHA256
4644ac3a346995aaca51020d5671c77997343bedc4b4ee30bfa373a33cb1a41c
-
SHA512
53072e7aa8996911ada023c722a5789bab9785e1a1d15a7b3abd88703e32acc402b00dadefeec5bc83315e95fd30babaa8551a7431e973f2a81bd80298765057
-
SSDEEP
3072:M5XoHUkFrEiNEzI28CB6KVJ3M778b71vt8j/1V6:F0kFrEiN+IpCBx9yj/1V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8f1aa4f9e843bc3528ac3c04cf86cf5_JaffaCakes118
Files
-
b8f1aa4f9e843bc3528ac3c04cf86cf5_JaffaCakes118.dll windows:4 windows x86 arch:x86
1eeff1c6415a577a6c9a6dc7fec6125a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleFileNameA
SetFileAttributesA
WriteProcessMemory
ReadProcessMemory
GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetLocaleInfoW
SetEndOfFile
CreateFileA
LoadLibraryA
GetOEMCP
GetACP
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
RtlUnwind
RaiseException
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
HeapReAlloc
ExitProcess
LCMapStringA
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
WriteFile
SetFilePointer
FlushFileBuffers
CloseHandle
TerminateProcess
HeapSize
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetVersionExA
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
ReadFile
SetEnvironmentVariableA
user32
MessageBoxA
ws2_32
gethostbyname
wininet
HttpSendRequestW
HttpSendRequestA
Sections
.text Size: 128KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ