Cron
Static task
static1
Behavioral task
behavioral1
Sample
bea49839390e4f1eb3cb38d0fcaf897e_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bea49839390e4f1eb3cb38d0fcaf897e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bea49839390e4f1eb3cb38d0fcaf897e_JaffaCakes118
-
Size
1.3MB
-
MD5
bea49839390e4f1eb3cb38d0fcaf897e
-
SHA1
ab7b57d836ce459fd3f4255d531b45bdcb228ce8
-
SHA256
cdac934dbd8831b962718fdbaf050ebaa8b89be6c98c8cd7479a9d91939c63c6
-
SHA512
aec843ae7ea528afec55ef75e4aaa30b20644b6609172adaf9e641dc6e5afb865664f0aa1e5b69d6ef749273121c5f72004cb56564e857c7b1287f1c4de6039f
-
SSDEEP
24576:FNAv4ae7HCiL+qPotB8jBg2oF2pO67IVLlxuhDM0fRVlKPHTbjc1o:3KIjRRa8AGJrfRVlKPHTvc1o
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bea49839390e4f1eb3cb38d0fcaf897e_JaffaCakes118
Files
-
bea49839390e4f1eb3cb38d0fcaf897e_JaffaCakes118.dll windows:6 windows x86 arch:x86
4b61a41e54174ca5891572c098410c02
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DeleteFiber
CreateFiber
WideCharToMultiByte
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
QueryPerformanceCounter
GetCurrentProcessId
GetTickCount
GlobalMemoryStatus
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
SetLastError
GetSystemTime
SystemTimeToFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
MultiByteToWideChar
SetConsoleCtrlHandler
ReadFile
GetModuleFileNameA
GetStringTypeW
GetACP
HeapFree
HeapAlloc
HeapReAlloc
CompareStringW
LCMapStringW
GetConsoleCP
CloseHandle
FlushFileBuffers
SetFilePointerEx
SetStdHandle
FindClose
FindFirstFileExA
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
WriteConsoleW
CreateFileW
HeapSize
SetEndOfFile
DecodePointer
GetProcAddress
GetModuleHandleW
GetLastError
WriteFile
GetFileType
GetStdHandle
SwitchToFiber
FindFirstFileW
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetCurrentDirectoryW
GetFullPathNameW
CreateThread
WaitForSingleObject
lstrcpyW
VirtualAlloc
GetModuleHandleExW
VirtualFree
GetTimeZoneInformation
ws2_32
recv
send
WSASetLastError
WSAGetLastError
WSACleanup
WSAStartup
__WSAFDIsSet
closesocket
select
inet_addr
socket
connect
htons
setsockopt
user32
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
advapi32
CryptGetUserKey
RegisterEventSourceW
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
DeregisterEventSource
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
crypt32
CertOpenStore
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertCloseStore
Exports
Exports
Sections
.text Size: 938KB - Virtual size: 938KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 340KB - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ