Exucute
Static task
static1
Behavioral task
behavioral1
Sample
c0cd6581e0fcbcedc7eede03471ace4d_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
c0cd6581e0fcbcedc7eede03471ace4d_JaffaCakes118
-
Size
52KB
-
MD5
c0cd6581e0fcbcedc7eede03471ace4d
-
SHA1
d132ac4e0fd4cc2766cf4184abe086d684788b5e
-
SHA256
b4f57118f439293c180af375eee1e117e23d2021bea9e03b57bb274592b17d00
-
SHA512
0b7393a0dee96186e43944ad7ffa4f5fd57042de8656a126898141ba19dbe5674e20512fee7d8dbfa8a1f2ed4eaf5ac088b1747b32ef50a93a9d4d0f707bf5ac
-
SSDEEP
768:3ksiHHVVbX4M/vJbAgDPBmFPE03q8ZChS6MsGmnTED55TvyCu1jwKDxhfpy9:3/mH7bo2FpsTpZeS6MI9vnxhBy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c0cd6581e0fcbcedc7eede03471ace4d_JaffaCakes118
Files
-
c0cd6581e0fcbcedc7eede03471ace4d_JaffaCakes118.dll windows:5 windows x86 arch:x86
9a36bf7d2561daefd227467b3e92d494
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Process32Next
DeviceIoControl
GetModuleHandleA
CreateToolhelp32Snapshot
CloseHandle
DeleteFileA
CreateThread
lstrcpyA
LoadLibraryA
GetTickCount
WriteFile
FreeLibrary
Module32First
Module32Next
LocalAlloc
LocalFree
RemoveDirectoryA
GetProcAddress
CreateDirectoryA
lstrcatA
GetSystemDirectoryA
Sleep
GetProcessHeap
WaitForSingleObject
Process32First
HeapFree
HeapAlloc
CreateFileA
HeapSize
GetStringTypeW
MultiByteToWideChar
GetCurrentThreadId
DecodePointer
GetCommandLineA
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
GetLastError
InterlockedDecrement
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetModuleFileNameW
RtlUnwind
LCMapStringW
IsProcessorFeaturePresent
advapi32
RegEnumKeyA
RegQueryInfoKeyA
RegOpenKeyExA
RegDeleteKeyA
ControlService
OpenSCManagerA
StartServiceA
CreateServiceA
DeleteService
CloseServiceHandle
OpenServiceA
RegCloseKey
Exports
Exports
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ