Static task
static1
Behavioral task
behavioral1
Sample
c188499cfe3b500330edd023ba4c3277_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c188499cfe3b500330edd023ba4c3277_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c188499cfe3b500330edd023ba4c3277_JaffaCakes118
-
Size
31KB
-
MD5
c188499cfe3b500330edd023ba4c3277
-
SHA1
5e03a0c09bbb17b8631bf7676375a8e858c14c75
-
SHA256
190b970804b40f5a86f6d0af6ae5c7dbb702a28a07aa0f27c2a0346b5801cec5
-
SHA512
6bd8ebd35534fb2d25f2e9bc5b63930e29eebba8252ffa3dc24b68eaeb48eac917152344caba12324b2d304ef50c7da6152d9dd03deb9490b283d03723045e4c
-
SSDEEP
384:a/A9sKKhYHX+GjETyTCThNwd+6hT5cDLkLJyyJmIgBuajaX2yUeGx06ledVwDOQ:kAyKYGCoFchomIiJjU2neGxzlOMOy/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c188499cfe3b500330edd023ba4c3277_JaffaCakes118
Files
-
c188499cfe3b500330edd023ba4c3277_JaffaCakes118.dll windows:6 windows x86 arch:x86
28610d3bd0bf4ed86540f8f21f6a8c48
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
RtlRandom
msi
ord123
ord20
ord8
ord158
ord118
ord160
ord159
ord17
ord32
ord92
kernel32
FindClose
MultiByteToWideChar
HeapFree
HeapAlloc
ResetEvent
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
VirtualAlloc
VirtualFree
GetModuleHandleA
GetProcAddress
GetCurrentProcess
LocalFree
GetModuleFileNameW
GetVersion
GetComputerNameW
LoadLibraryA
FreeLibrary
GetTickCount
HeapCreate
CreateEventW
CreateThread
SetEvent
WaitForSingleObject
CloseHandle
CreateFileW
GetLastError
FindFirstFileW
FindNextFileW
GetFileSize
ReadFile
WriteFile
SetEndOfFile
DeleteFileW
GetTempPathW
GetTempFileNameW
GetLogicalDriveStringsW
GetDriveTypeW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
LeaveCriticalSection
GetCurrentProcessId
CreateMutexW
WaitForMultipleObjects
OpenProcess
SetLastError
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ