Static task
static1
Behavioral task
behavioral1
Sample
bbbb4388695cac1281f04c39da0c1883_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bbbb4388695cac1281f04c39da0c1883_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bbbb4388695cac1281f04c39da0c1883_JaffaCakes118
-
Size
184KB
-
MD5
bbbb4388695cac1281f04c39da0c1883
-
SHA1
203e5cad8e92e1331c714b0a3ca0c54f276bb694
-
SHA256
5a7efffd09cc9a6e28ca82a94078613efba9b54653e0815b4ce78608837ada41
-
SHA512
08dbcc13b3fcbb7f03b8f4fa01bfb57684ab8a9b70f369d14c24aaaaf86a206238ebe12e33bee42e7ba7fad97353b52cf1aeacc8dd7b60878fad469fa37d7add
-
SSDEEP
3072:B/CFb8BVJlvOUM0Y9icOefhixXsQZD2b6jtWJdn4RIl11hCoPMqqDLy/s1W:JCFA53MLWefAoO6OIlhWqqDLuuW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bbbb4388695cac1281f04c39da0c1883_JaffaCakes118
Files
-
bbbb4388695cac1281f04c39da0c1883_JaffaCakes118.dll windows:4 windows x86 arch:x86
d06bd0b1589eb206119b16d63f01c97c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
InterlockedExchange
ExitProcess
GetUserDefaultLCID
GetProcAddress
LoadLibraryA
WideCharToMultiByte
InterlockedIncrement
lstrlenA
FreeLibrary
lstrlenW
CreateFileA
GetACP
MultiByteToWideChar
RaiseException
VirtualAlloc
GetProcessHeap
GetShortPathNameW
InterlockedCompareExchange
GetFileAttributesA
ExpandEnvironmentStringsA
ReleaseMutex
WaitForSingleObject
InterlockedDecrement
CloseHandle
CreateFileW
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
lstrcpyW
ReleaseSemaphore
CreateThread
FormatMessageW
ExpandEnvironmentStringsW
lstrcpynW
GetStringTypeA
GetStringTypeW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetLocalTime
GetLocaleInfoA
SetUnhandledExceptionFilter
LocalFree
LocalAlloc
GetCommandLineA
GetFullPathNameA
VirtualProtect
LCMapStringW
LCMapStringA
GetOEMCP
RtlUnwind
GetVersion
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
HeapAlloc
HeapReAlloc
GetCPInfo
user32
LoadStringW
advapi32
GetLengthSid
IsValidSid
RegQueryValueExW
EqualSid
CopySid
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
ReportEventW
ole32
CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize
Sections
.text Size: 142KB - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ