qadazld
Static task
static1
Behavioral task
behavioral1
Sample
bbaf29fca338956b1174a8fb992fb501_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bbaf29fca338956b1174a8fb992fb501_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bbaf29fca338956b1174a8fb992fb501_JaffaCakes118
-
Size
507KB
-
MD5
bbaf29fca338956b1174a8fb992fb501
-
SHA1
071ec0f9c6044d21d62612392fa8c392b5ffa302
-
SHA256
04d885532e4a5997455b2990e8c64c3a9273c98974153c7a2c1447cb64242fbb
-
SHA512
4c974a2ed58336d585fcab9a38277ee9dec49a711a71c9debcddeafa95ad2fc1ee6a532790490d5c58f0a0c8a9bfb9f858b291642ff4b2b5e7f7e2d3e14e1135
-
SSDEEP
6144:35V42i2Jfqcx0qUXFN7U83Fs2g6//zAvQv66yhetdzzqg+hyr9vOghb8Rq+n5:JiH33JXFru2/zhI4v+h2OAW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bbaf29fca338956b1174a8fb992fb501_JaffaCakes118
Files
-
bbaf29fca338956b1174a8fb992fb501_JaffaCakes118.dll windows:4 windows x86 arch:x86
b714e698fb14d25b4d46d52f38d9a158
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExitProcess
CreateFileA
MoveFileWithProgressA
FillConsoleOutputCharacterA
ReadConsoleInputA
EnumCalendarInfoExA
HeapFree
GetProcessHeap
HeapAlloc
ExitThread
Beep
user32
LoadStringW
ExitWindowsEx
MessageBeep
GetSystemMetrics
BroadcastSystemMessageA
GetCursorPos
GetMessageTime
advapi32
RegDeleteValueW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextW
OpenProcessToken
GetTokenInformation
RegSetValueExW
AllocateAndInitializeSid
LookupAccountSidW
FreeSid
OpenThreadToken
SetThreadToken
RevertToSelf
RegQueryInfoKeyW
RegQueryValueExW
RegNotifyChangeKeyValue
RegOpenKeyExW
CloseServiceHandle
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
RegOpenKeyW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
CryptSetProvParam
CryptGetProvParam
CryptReleaseContext
RegConnectRegistryW
rpcrt4
RpcImpersonateClient
RpcServerInqDefaultPrincNameW
RpcServerRegisterAuthInfoW
RpcServerRegisterIfEx
RpcBindingToStringBindingW
RpcServerListen
RpcStringFreeW
I_RpcBindingIsClientLocal
RpcStringBindingParseW
RpcServerRegisterIf
NdrServerCall2
RpcRaiseException
I_RpcBindingInqLocalClientPID
RpcServerUseProtseqEpW
RpcRevertToSelf
Exports
Exports
Sections
.text Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 463KB - Virtual size: 463KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ