Static task
static1
Behavioral task
behavioral1
Sample
bd0ae76d3e323e8889843fcbb4123a74_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bd0ae76d3e323e8889843fcbb4123a74_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bd0ae76d3e323e8889843fcbb4123a74_JaffaCakes118
-
Size
68KB
-
MD5
bd0ae76d3e323e8889843fcbb4123a74
-
SHA1
c6fe70bf73408ad8b93db6f2eb620ffa9ab56e04
-
SHA256
ce5afa4442a7bc8f22c29d1dd4406cd2f8640963976581ccd74d465169fb108d
-
SHA512
a77350bab6c321cc3d5fc62d09db70a9277788ba235d78131e7f3b044a8a1bc6774f15966e895f659ab29902498484fdeaeabe5cb93d88957aa21c85b665d9f3
-
SSDEEP
1536:IuDiG5DdPLNE+AzkbIy4tSMzCmxJSZPxvx3EgIWg:IKiG5dLNE+AzkbIy4tXzcZJJUgv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bd0ae76d3e323e8889843fcbb4123a74_JaffaCakes118
Files
-
bd0ae76d3e323e8889843fcbb4123a74_JaffaCakes118.dll windows:4 windows x86 arch:x86
10d4f5f58cf040d0f08d9fde55f3958e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
DisableThreadLibraryCalls
EnumUILanguagesW
CloseHandle
CreateProcessW
InterlockedExchange
HeapAlloc
GetProcessHeap
SetUnhandledExceptionFilter
lstrlenA
MultiByteToWideChar
GetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
LeaveCriticalSection
InterlockedDecrement
SetLastError
GetCommandLineA
VirtualProtect
VirtualFree
HeapFree
VirtualAlloc
user32
LoadStringA
PostMessageA
advapi32
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExA
RegOpenKeyExW
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
msvcr71
__CppXcptFilter
wcschr
wcscmp
wprintf
_wcsicmp
_CxxThrowException
_except_handler3
_adjust_fdiv
_amsg_exit
_initterm
free
_XcptFilter
malloc
_onexit
_lock
__dllonexit
memset
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ