Static task
static1
Behavioral task
behavioral1
Sample
bc08a2276ff97acc64f0dc8c9ae2c8f7_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bc08a2276ff97acc64f0dc8c9ae2c8f7_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bc08a2276ff97acc64f0dc8c9ae2c8f7_JaffaCakes118
-
Size
88KB
-
MD5
bc08a2276ff97acc64f0dc8c9ae2c8f7
-
SHA1
f878b8cf8a4d89696d6d16a23b679842c010fcce
-
SHA256
beea36def1a49c27f4fb4f2df897132fcdea029c4ae1dc35be2976b22ffbe137
-
SHA512
3e5f8163759c81c929205d6ad2f41fe3460923c4e2b9a36541c4d26119582eead14d32bf1da6135e744015d08e264318f5339ea461029ec2340112d995fffdf5
-
SSDEEP
1536:WIKv9ApmF6ZJB7gQE4NUp14SQo0YMvnfQphYtT2UggITys3XrtL1qAV:rKVApm4ZhNUp14SQodMPfSYtT2hLXJYg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc08a2276ff97acc64f0dc8c9ae2c8f7_JaffaCakes118
Files
-
bc08a2276ff97acc64f0dc8c9ae2c8f7_JaffaCakes118.dll windows:4 windows x86 arch:x86
343b6c4fbb378636f1300ba7696a3d6a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
MoveFileA
SetUnhandledExceptionFilter
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetVolumeInformationA
SetCurrentDirectoryA
GetCurrentDirectoryA
LocalFree
FreeLibrary
GetWindowsDirectoryA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetStringTypeA
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
lstrlenA
lstrcpynA
lstrcpyA
lstrcatA
GetCommandLineA
CreateFileA
CloseHandle
GetPrivateProfileIntA
GetSystemDirectoryA
GetPrivateProfileStringA
lstrcmpiA
CreateDirectoryA
GetSystemInfo
GetVersionExA
GetProcessHeap
MultiByteToWideChar
VirtualProtect
FormatMessageA
HeapAlloc
HeapFree
RtlUnwind
GetVersion
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetStringTypeW
user32
CharNextA
LoadStringA
MessageBoxExA
wsprintfA
CharPrevA
advapi32
SetNamedSecurityInfoA
GetSidSubAuthority
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegOpenKeyExA
RegCloseKey
InitializeSid
GetSidLengthRequired
RegQueryValueExA
RegEnumValueA
GetSecurityDescriptorDacl
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ