DumpKernel
Static task
static1
Behavioral task
behavioral1
Sample
dd9cae5d8835d9e959b8351f9663d3ed_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dd9cae5d8835d9e959b8351f9663d3ed_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
dd9cae5d8835d9e959b8351f9663d3ed_JaffaCakes118
-
Size
71KB
-
MD5
dd9cae5d8835d9e959b8351f9663d3ed
-
SHA1
f6a4c24a89f70474d253e4b03ab39530e2a0aa28
-
SHA256
082807f090482806c0cf9b20d4462a2e2e596232ed9a2e61d954b494735092f6
-
SHA512
715ebae28c9a7d43016f5a273d0fddd00d6f561b26c0a2c684affb7eb5db09688f6ca4ee548af1ce817529866a27ce3cecb4617f82a1cfe26da47608d69a07eb
-
SSDEEP
1536:vHdN+D7xwNRmjy1WZW1ANeTEyjkCDuVo+/:vfu7edoF4jXuVo+/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd9cae5d8835d9e959b8351f9663d3ed_JaffaCakes118
Files
-
dd9cae5d8835d9e959b8351f9663d3ed_JaffaCakes118.dll windows:4 windows x86 arch:x86
2c4e69c5da1f1ee77f0bab2cc0be0d64
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateFileA
lstrlenA
FindClose
GetLastError
FindNextFileA
lstrcatA
FindFirstFileA
GetDriveTypeA
lstrcpyA
GetSystemDirectoryA
SetCurrentDirectoryA
WriteFile
TerminateProcess
GetExitCodeProcess
PeekNamedPipe
GetTickCount
CreateProcessA
CreatePipe
GetVersionExA
GetLocaleInfoA
lstrcmpA
GetProcAddress
LoadLibraryA
lstrcpynA
VirtualAlloc
VirtualFree
GetFileSize
WaitForSingleObject
GetCurrentDirectoryA
LocalFree
FlushFileBuffers
LCMapStringW
LCMapStringA
SetStdHandle
HeapReAlloc
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
SetUnhandledExceptionFilter
CloseHandle
SetFilePointer
ReadFile
Sleep
CreateThread
WinExec
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
RaiseException
InitializeCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapAlloc
RtlUnwind
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
ExitProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
HeapFree
EnterCriticalSection
LeaveCriticalSection
user32
wsprintfA
IsCharAlphaNumericA
wininet
InternetQueryOptionA
ws2_32
inet_addr
ntohl
setsockopt
connect
WSAStartup
__WSAFDIsSet
htons
inet_ntoa
gethostname
send
select
recv
closesocket
gethostbyname
getsockopt
WSAGetLastError
WSACleanup
socket
advapi32
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey
RegEnumKeyExA
shlwapi
PathFindExtensionA
oleaut32
GetErrorInfo
Exports
Exports
Sections
.text Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 338KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ