DllGetClassObject
Static task
static1
Behavioral task
behavioral1
Sample
bfa0c9ec67cd0f1b2dabfc7777aae294_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bfa0c9ec67cd0f1b2dabfc7777aae294_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bfa0c9ec67cd0f1b2dabfc7777aae294_JaffaCakes118
-
Size
42KB
-
MD5
bfa0c9ec67cd0f1b2dabfc7777aae294
-
SHA1
c15a4686bda91546e4c3abba58530423c40da3dc
-
SHA256
f3a8ac1721abb9068c5c281dafeaebdf3a66f96954c9e882ef71dee9c44bc585
-
SHA512
e2e7b989e17dcf2f0c2b93e53671a6f34230b31b0daa152fd9ec84aa14055b1350960d5dbc7da02a03d4eda7c68f9082f6c8be053ec56c0bed5b2bd0ef38556f
-
SSDEEP
768:ycpSv3cJaj3c/sZ6VV++yssszZXzuHmfi+Rv8pjPRsN:y+SvsgsG6VVYYiHev8vsN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bfa0c9ec67cd0f1b2dabfc7777aae294_JaffaCakes118
Files
-
bfa0c9ec67cd0f1b2dabfc7777aae294_JaffaCakes118.dll windows:5 windows x64 arch:x64
278529be30191785bb5033e49843ad7c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ntdll
ZwSetInformationFile
ZwSetEaFile
RtlComputeCrc32
wcstoul
ZwQueryDirectoryFile
ZwQueryEaFile
qsort
RtlTimeToSecondsSince1980
ZwUnmapViewOfSection
ZwMapViewOfSection
RtlNtStatusToDosError
ZwSetLowEventPair
ZwWaitHighEventPair
ZwSetHighWaitLowEventPair
ZwCreateEventPair
ZwDeleteFile
ZwQuerySystemInformation
RtlAdjustPrivilege
ZwAdjustPrivilegesToken
ZwOpenThreadTokenEx
ZwImpersonateThread
ZwOpenThread
ZwCreateSection
ZwCreateFile
strcpy
memset
ZwSetValueKey
wcscpy
LdrFindEntryForAddress
ZwCreateEvent
ZwQueryInformationToken
ZwOpenProcessToken
RtlExpandEnvironmentStrings_U
RtlFreeUnicodeString
ZwQueryValueKey
ZwOpenKey
RtlFormatCurrentUserKeyPath
memcpy
ZwQueryVolumeInformationFile
ZwOpenEvent
ZwWriteFile
ZwClose
ZwReadFile
RtlInitUnicodeString
ZwOpenFile
wcscat
wcsrchr
LdrGetProcedureAddress
swprintf
wcslen
RtlExitUserThread
LdrProcessRelocationBlock
RtlImageDirectoryEntryToData
RtlAddressInSectionTable
RtlImageNtHeader
__chkstk
__C_specific_handler
kernel32
CreateThread
DisableThreadLibraryCalls
DeleteTimerQueueTimer
GetProcAddress
DeleteCriticalSection
InitializeCriticalSection
SleepEx
Sleep
FreeLibrary
LoadLibraryW
VirtualFree
LeaveCriticalSection
VirtualAlloc
EnterCriticalSection
LoadLibraryA
CreateTimerQueueTimer
GetSystemTimeAsFileTime
GetLastError
BindIoCompletionCallback
LocalFree
LocalAlloc
advapi32
CryptAcquireContextW
MD5Update
MD5Final
CryptImportKey
CryptGenRandom
CryptDestroyKey
CryptReleaseContext
CryptCreateHash
CryptSetHashParam
CryptVerifySignatureW
CryptDestroyHash
MD5Init
mswsock
AcceptEx
ws2_32
WSAStartup
WSACleanup
WSASocketW
WSAGetLastError
closesocket
bind
listen
WSAIoctl
WSARecv
WSASend
setsockopt
WSASendTo
WSARecvFrom
Exports
Exports
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 876B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 282B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ