Static task
static1
Behavioral task
behavioral1
Sample
c8c801c4b3f04c220be76b10250394c2_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c8c801c4b3f04c220be76b10250394c2_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c8c801c4b3f04c220be76b10250394c2_JaffaCakes118
-
Size
136KB
-
MD5
c8c801c4b3f04c220be76b10250394c2
-
SHA1
7a9a4230c86fe7d4207aebd6fe357a76d8d86e69
-
SHA256
3c30bfa639e254f1b65a39a77ef3ee4de142e1592f482223c0a9991965cfa3c7
-
SHA512
5a167050b35106763de5b5c12ad723dd329b48b9e6d5bf587e2d645c3b195084ed6c4581aa2ffa7842f70922ada52dd0704ea88b820abf9dd5fe95ea8c8d2463
-
SSDEEP
3072:uBOkOTAXQSao4lmaO1yOsLxxNlchKFYPih:uHcAASahl3O1WUhKf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c8c801c4b3f04c220be76b10250394c2_JaffaCakes118
Files
-
c8c801c4b3f04c220be76b10250394c2_JaffaCakes118.dll windows:4 windows x86 arch:x86
e9c61481a816357e6209b49238c1b299
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLocaleInfoA
LocalAlloc
LocalFree
InterlockedExchange
InterlockedCompareExchange
Sleep
WaitForSingleObject
GetCurrentThreadId
lstrcatA
CloseHandle
lstrcpyA
TerminateThread
SetEvent
WaitForSingleObjectEx
lstrlenW
GetSystemInfo
FreeLibrary
GetProcAddress
LoadLibraryW
GetLocalTime
FlushViewOfFile
OutputDebugStringA
IsBadWritePtr
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
DeviceIoControl
CreateFileW
GetFileSize
VirtualProtect
FindFirstFileW
lstrlenA
MultiByteToWideChar
LoadLibraryExW
IsDebuggerPresent
DebugBreak
GetCurrentProcess
GetCurrentThread
GetWindowsDirectoryA
GetVersionExA
GetModuleFileNameW
GetModuleHandleW
GetCurrentProcessId
lstrcatW
FormatMessageW
GetThreadContext
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetStringTypeA
LCMapStringW
LCMapStringA
HeapSize
LoadLibraryA
HeapReAlloc
VirtualAlloc
GetCPInfo
FindClose
GetCommandLineA
GetOEMCP
GetACP
HeapAlloc
RtlUnwind
VirtualQuery
ExitProcess
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
UnhandledExceptionFilter
GetStringTypeW
user32
SetProcessWindowStation
GetProcessWindowStation
LoadStringW
wsprintfW
wvsprintfW
wsprintfA
DialogBoxParamW
advapi32
RegisterEventSourceW
ole32
CoTaskMemAlloc
CoTaskMemFree
Sections
.text Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ