Libnetdsc
Static task
static1
Behavioral task
behavioral1
Sample
bb6a08e5e5f33e8f0a5f0ec952e031cb_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bb6a08e5e5f33e8f0a5f0ec952e031cb_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bb6a08e5e5f33e8f0a5f0ec952e031cb_JaffaCakes118
-
Size
80KB
-
MD5
bb6a08e5e5f33e8f0a5f0ec952e031cb
-
SHA1
03c92f0630017d3be45defa8a4110d834e331115
-
SHA256
60fca0e633e8af40d72482befb69e92e54d4728e31432afd7bab5d2d872839f1
-
SHA512
afcc13813360284d37c02c0923145a9b74a2d7a7c2a8f1f26e52fda0598ec34a89ca8b75ad2ab112440f1e0a5db5dc96353a4b118e3a738d9ddfe0c663c8560f
-
SSDEEP
1536:COAN8xu3lJABeMIAwQCP3G4cIeXzBCTwmufUteOduEurrUL6y9vl:COyJABeMIAxfXzBCsbCeeutrUL6y9d
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bb6a08e5e5f33e8f0a5f0ec952e031cb_JaffaCakes118
Files
-
bb6a08e5e5f33e8f0a5f0ec952e031cb_JaffaCakes118.dll windows:4 windows x86 arch:x86
94ca98b8930d1b100cfcbcd37aeaa615
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CopyFileA
VirtualProtect
GetModuleFileNameA
GetProcAddress
CreateMutexA
HeapFree
GetVolumeInformationA
CreateFileMappingA
InterlockedDecrement
GetCurrentProcessId
lstrlenA
EnterCriticalSection
GetProcessHeap
GetSystemTimeAsFileTime
GetCommandLineA
CreateProcessA
GetTickCount
LoadLibraryA
InterlockedExchange
LocalFree
lstrlenW
SetLastError
MapViewOfFile
GetLastError
GetSystemDirectoryA
FindActCtxSectionStringW
GetSystemDefaultLangID
CreateMailslotA
PeekConsoleInputA
SwitchToThread
GetFullPathNameW
GetCurrentActCtx
CompareStringA
ResetEvent
GlobalFlags
GetComputerNameExW
GetModuleFileNameW
AddAtomA
GetFullPathNameA
AssignProcessToJobObject
IsValidLanguageGroup
VirtualFree
FindResourceW
SetDefaultCommConfigW
SizeofResource
MoveFileExW
GetFileAttributesW
SetConsoleMode
FindNextFileA
WaitNamedPipeA
CreateIoCompletionPort
FreeConsole
TerminateProcess
WaitForSingleObjectEx
CreateWaitableTimerA
GlobalFindAtomW
IsBadCodePtr
GetDateFormatA
OpenEventW
CopyFileExW
TransmitCommChar
GetVolumePathNamesForVolumeNameW
GetAtomNameW
WriteProfileStringW
GetQueuedCompletionStatus
FindResourceExA
OpenFile
FindNextFileW
GetFileTime
ChangeTimerQueueTimer
VirtualQueryEx
CreateMailslotW
SetProcessShutdownParameters
AddAtomW
CancelIo
GetCurrentDirectoryW
BeginUpdateResourceA
GetAtomNameA
LocalAlloc
FindFirstVolumeW
WaitForMultipleObjects
SetProcessWorkingSetSize
BackupRead
FindFirstFileA
EnumResourceLanguagesA
GetConsoleMode
LocalReAlloc
FindFirstFileExW
TerminateJobObject
GetCurrentThread
LockFile
FindVolumeClose
CancelWaitableTimer
ole32
CreateDataAdviseHolder
RegisterDragDrop
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
MkParseDisplayName
OleCreateFromData
IIDFromString
StgIsStorageFile
OleQueryLinkFromData
StgOpenStorage
OleTranslateAccelerator
CoTaskMemAlloc
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoInitialize
shlwapi
StrStrW
StrFormatByteSizeW
PathRemoveFileSpecA
StrDupA
PathGetArgsW
StrTrimW
StrStrA
PathUndecorateW
UrlUnescapeW
StrStrIW
PathIsDirectoryW
Exports
Exports
Sections
.text Size: 60KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ