Static task
static1
Behavioral task
behavioral1
Sample
dbed59bbeed4d287f776c1687118aadf_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dbed59bbeed4d287f776c1687118aadf_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
dbed59bbeed4d287f776c1687118aadf_JaffaCakes118
-
Size
311KB
-
MD5
dbed59bbeed4d287f776c1687118aadf
-
SHA1
091fc32a1189e683a3276e8be1fb8af059c21999
-
SHA256
32b5361c1ccf43dc7a98fb109959d66a97d1c9ca6636239bc05576295f992ece
-
SHA512
bf11d153495815986dcb2ea462664d7842e3de3921a32efaa0cf488f267083e7ba95474e76d6f369d4a2e3e44fb69feb148f20c705ca3e76868e6a24baa104bd
-
SSDEEP
6144:3gIZrqBSESDU1hBtDD9eoHTAz2Yt6eJQExQE9WtAKSw6uOOUn:3gDkKDDPN9BcQEItKke
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dbed59bbeed4d287f776c1687118aadf_JaffaCakes118
Files
-
dbed59bbeed4d287f776c1687118aadf_JaffaCakes118.dll windows:4 windows x86 arch:x86
a105e42da7b521f2f6a15056183f6b60
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CreateFileA
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileA
FreeLibrary
GetCommandLineA
GetCurrentThreadId
GetFileSize
GetFileType
GetLastError
GetModuleFileNameA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalAlloc
LocalFree
OpenMutexA
OpenProcess
ReadFile
ResumeThread
SetEndOfFile
SetFilePointer
Sleep
TerminateThread
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
user32
BeginPaint
CheckMenuRadioItem
CheckRadioButton
CreateMenu
CreateWindowExA
DestroyCursor
DestroyWindow
EndPaint
ExitWindowsEx
FindWindowExA
GetCapture
GetCursorPos
GetDC
GetSystemMetrics
GetWindow
GetWindowDC
GetWindowDC
GetWindowTextA
GetWindowTextLengthA
InvalidateRect
IsWindow
KillTimer
LoadCursorA
LoadIconA
LoadStringA
MessageBoxA
PeekMessageA
PostMessageA
PostQuitMessage
RegisterClassA
ReleaseCapture
ReleaseDC
SendMessageA
SetCursor
wvsprintfA
gdi32
CombineRgn
CreateBrushIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
SetWindowOrgEx
StretchBlt
TextOutA
shell32
DllRegisterServer
DllUnregisterServer
ShellExecuteA
SHGetPathFromIDList
comdlg32
ChooseFontA
Sections
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: 25KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CODE Size: 158KB - Virtual size: 456KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ