Static task
static1
Behavioral task
behavioral1
Sample
b9971e5c49ba447883721a1e98e59f14_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b9971e5c49ba447883721a1e98e59f14_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b9971e5c49ba447883721a1e98e59f14_JaffaCakes118
-
Size
126KB
-
MD5
b9971e5c49ba447883721a1e98e59f14
-
SHA1
57d3456897f71b577d3d6fab26f375f619c07c4e
-
SHA256
488b8f6151e5742c5b88812498d6238f43c7c62086153939a2b4b6a6c9428197
-
SHA512
df550a6b5d7ab3c9188ebd2f1d50815f8b870e107f1df7dcb0af74b710a6fe5ab8d8937035385bd9a005c10cc442db8aac271f248bf21667aec07c89b5854a86
-
SSDEEP
3072:svMToquYaQrsa/iffa2TmuyofRY2FQvdXCb:IMToq5IamC2Cu9fRY2F3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b9971e5c49ba447883721a1e98e59f14_JaffaCakes118
Files
-
b9971e5c49ba447883721a1e98e59f14_JaffaCakes118.dll windows:4 windows x86 arch:x86
fc0e302eb8b5f920f7599a22d3f7dad1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExitProcess
FreeEnvironmentStringsW
GetVersionExA
InterlockedDecrement
GetLocaleInfoA
EndUpdateResourceA
GetProcAddress
LoadLibraryA
CreateThread
lstrcmpiW
WriteFile
GetModuleHandleW
FormatMessageA
HeapFree
TerminateProcess
GetOEMCP
GetLocalTime
GlobalFree
GlobalLock
GetLastError
GlobalUnlock
GetModuleHandleA
msvcrt
atoi
wcslen
swprintf
isleadbyte
wcscat
memset
__set_app_type
memcpy
free
__dllonexit
wcscmp
_vsnprintf
iswalnum
wcstok
_wcsicmp
isdigit
_acmdln
isspace
strchr
iscntrl
wcstol
_wtol
fclose
__getmainargs
_adjust_fdiv
user32
MessageBeep
RegisterShellHookWindow
EndDialog
CopyRect
DrawIconEx
GetMenu
AppendMenuW
DrawTextW
GetWindowLongA
IsDlgButtonChecked
GetMessageA
FrameRect
IsWindowVisible
DefWindowProcW
FindWindowW
LoadStringW
SetWindowTextW
DrawEdge
LoadStringA
OemToCharW
PeekMessageW
RedrawWindow
CharUpperW
LoadMenuA
SetScrollPos
SystemParametersInfoA
gdi32
ExtTextOutW
GetTextExtentPointW
CreatePalette
TranslateCharsetInfo
GetTextExtentPoint32W
Rectangle
GetTextMetricsW
PatBlt
CreateSolidBrush
SetBkColor
CreateCompatibleDC
LineTo
DeleteObject
StretchBlt
MoveToEx
CreateFontIndirectW
tapi32
lineConfigDialogEdit
lineGetDevConfigW
lineCreateAgentSessionW
phoneGetButtonInfo
lineGetAddressCaps
lineSetAgentStateEx
lineDrop
phoneGetMessage
comdlg32
GetOpenFileNameW
shell32
ShellAboutW
SHGetPathFromIDListW
SHGetMalloc
SHGetFolderPathW
ShellExecuteW
SHGetSpecialFolderLocation
winmm
mixerGetLineInfoA
auxOutMessage
mmGetCurrentTask
mmioDescend
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
nes1 Size: 512B - Virtual size: 278B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
nes2 Size: 512B - Virtual size: 360B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
nes3 Size: 512B - Virtual size: 401B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nes4 Size: 512B - Virtual size: 306B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ