FGInit
Static task
static1
Behavioral task
behavioral1
Sample
c2841cfaab8cb288dee73f30874ecf66_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c2841cfaab8cb288dee73f30874ecf66_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c2841cfaab8cb288dee73f30874ecf66_JaffaCakes118
-
Size
272KB
-
MD5
c2841cfaab8cb288dee73f30874ecf66
-
SHA1
d9dc84e2ded848a21bb82265928c90a5b0363bab
-
SHA256
a64ab8019bf045c8cbb5f409e2b028675d26133752b85013ab5097e699a80833
-
SHA512
5de665abf7d787316beb5c88e086e09c9aa3ab14fe90d6b99493da60732c5fde2a1bf4c6f1bb5265aafbd01042567bb36c13574db8931359e6e8a3892569699e
-
SSDEEP
6144:QPg72UgirUUu9PhOotobV6KRfMSWEL9XNdNAJR3jn1k:IC2+nu9PhOotok8fMNEL9bNYJ1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c2841cfaab8cb288dee73f30874ecf66_JaffaCakes118
Files
-
c2841cfaab8cb288dee73f30874ecf66_JaffaCakes118.dll windows:4 windows x86 arch:x86
b3eb7bec4e0381e8af2b1565dcb023ae
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcatA
GetWindowsDirectoryA
lstrlenA
GlobalAlloc
GlobalFree
OutputDebugStringA
HeapDestroy
TlsFree
SetLastError
CloseHandle
FlushFileBuffers
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetFilePointer
SetStdHandle
GetTimeZoneInformation
GetSystemTimeAsFileTime
HeapAlloc
GetCommandLineA
GetVersion
GetProcAddress
GetModuleHandleA
RaiseException
WideCharToMultiByte
GlobalLock
HeapCreate
VirtualFree
HeapFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
VirtualAlloc
HeapReAlloc
RtlUnwind
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
InterlockedDecrement
WriteFile
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
LCMapStringW
ReadFile
InterlockedIncrement
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
LCMapStringA
user32
MessageBoxA
GetFocus
fbus32
ord29
ord52
ord50
ord59
ord17
ord11
ord60
ord27
ord53
ord51
ord40
ord32
ord91
ord80
ord20
ord73
ord86
ord8
ord31
ord49
ord16
ord76
ord30
ord77
ord2
ord88
ord3
ord58
halcon
HFgGetDefaults
HNewImagePtr
HAccessSysComInfo
HNewImage
HXFree
HSysInfo
IOSpyProcCall
HXAlloc
HProcessErr
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Exports
Exports
Sections
.text Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 196KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ