Static task
static1
Behavioral task
behavioral1
Sample
d9882bd9adc21c3539ac0c8dee815cd7_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d9882bd9adc21c3539ac0c8dee815cd7_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d9882bd9adc21c3539ac0c8dee815cd7_JaffaCakes118
-
Size
572KB
-
MD5
d9882bd9adc21c3539ac0c8dee815cd7
-
SHA1
4b5fd94893da7cf11577932532012c5cdd2cd461
-
SHA256
ccd3466c3b31c6524f12c0eb737a4e67b18ad588dc2b62ae9e843092ab1df92d
-
SHA512
f2bdcf5fe3a7068a464fa5e21200ace66a3dd35a36b7b41c8e18968f8e4a69b17dde2b1814c8b0f172fbbc9614037a02dfb6bb898d5db641747c6ab04f1a4b85
-
SSDEEP
6144:wDrphgQAly1w/7otxXZ4PP/hOv5n+fvWoAOYO2:wDPclyWTWxe65nivPY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d9882bd9adc21c3539ac0c8dee815cd7_JaffaCakes118
Files
-
d9882bd9adc21c3539ac0c8dee815cd7_JaffaCakes118.dll windows:4 windows x86 arch:x86
99da058c2703d6d0fce58e1e5e0e3749
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
winmm
timeGetTime
kernel32
GetProcAddress
GetModuleHandleA
GetCurrentProcess
WriteProcessMemory
VirtualProtect
Sleep
CreateThread
IsBadReadPtr
Module32Next
Module32First
CreateToolhelp32Snapshot
ExitProcess
SetStdHandle
GetPrivateProfileIntA
GetModuleFileNameA
GetVolumeInformationA
GetComputerNameA
VirtualQuery
HeapAlloc
GetProcessHeap
InterlockedExchange
InitializeCriticalSection
SetFilePointer
GetOEMCP
WritePrivateProfileStringA
TlsSetValue
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
ReadFile
SetEndOfFile
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetSystemInfo
VirtualAlloc
LoadLibraryA
IsBadCodePtr
IsBadWritePtr
SetUnhandledExceptionFilter
CreateFileA
WideCharToMultiByte
MultiByteToWideChar
TerminateProcess
GetSystemTimeAsFileTime
RtlUnwind
GetLocalTime
GetCurrentThreadId
GetCommandLineA
GetVersionExA
TlsAlloc
SetLastError
GetLastError
TlsFree
GetACP
TlsGetValue
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CloseHandle
GetTimeZoneInformation
RaiseException
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
GetCPInfo
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
FlushFileBuffers
user32
wsprintfA
FindWindowA
GetAsyncKeyState
advapi32
GetUserNameA
tier0
Msg
g_VProfCurrentProfile
?GetSubNode@CVProfNode@@QAEPAV1@PBDH0H@Z
?EnterScope@CVProfNode@@QAEXXZ
?ExitScope@CVProfNode@@QAE_NXZ
Error
g_pMemAlloc
GetCPUInformation
vstdlib
RandomSeed
RandomFloat
Q_strncpy
Q_snprintf
KeyValuesSystem
Q_strnicmp
Sections
.text Size: 552KB - Virtual size: 552KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE