Static task
static1
Behavioral task
behavioral1
Sample
de380a6bb89202aa6366d22874ec295f_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
de380a6bb89202aa6366d22874ec295f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
de380a6bb89202aa6366d22874ec295f_JaffaCakes118
-
Size
160KB
-
MD5
de380a6bb89202aa6366d22874ec295f
-
SHA1
b4014b3f0817afecb7c89c8f518eacd37884d777
-
SHA256
684e08dfe214168d466431cd33d044e50c26e70f364d48189c56d43dd7d98a0a
-
SHA512
b1d796bb9d5cb9bc9ad1b9a10727bbbba94ded9cbdd6c49ddfb0a1a94250ae580e1eb94c263ede2ecf8aaee391c7530d4a8eb37b3d9415cdd8c93fd62cd5fd54
-
SSDEEP
3072:fhRn1AYae0Gex10jBda2qQ5RQnglMMqqDLy/6hmGTWp41AJCm/H:f/nz0QFt5qKqqDLuamGTWcAUq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource de380a6bb89202aa6366d22874ec295f_JaffaCakes118
Files
-
de380a6bb89202aa6366d22874ec295f_JaffaCakes118.dll windows:4 windows x86 arch:x86
e4ce44af32498c053a880d48c278d340
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FindClose
FindFirstFileA
UnmapViewOfFile
lstrcmpA
MapViewOfFile
CloseHandle
CreateFileMappingA
GetFileSize
CreateFileA
lstrcatA
InterlockedDecrement
GetFileAttributesA
GetTimeZoneInformation
FindNextFileA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsFree
TerminateProcess
ExitProcess
LocalFree
GetCurrentProcess
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WaitForSingleObjectEx
CancelWaitableTimer
GetCommandLineW
GetDriveTypeW
GetConsoleOutputCP
CreateEventW
CreateWaitableTimerW
GetConsoleMode
SetConsoleMode
ReadConsoleW
WaitForSingleObject
FormatMessageW
GetStdHandle
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterW
SetConsoleCursorPosition
SetEvent
lstrcpynA
Sleep
GetModuleHandleW
InterlockedCompareExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrlenW
lstrcmpiW
GetModuleFileNameW
InterlockedIncrement
GetVersionExW
VirtualAlloc
VirtualQuery
MultiByteToWideChar
lstrcpyW
lstrcpynW
LoadLibraryW
lstrcatW
GetFileAttributesW
GetLocaleInfoA
GetStringTypeW
GetSystemInfo
GetStringTypeA
LCMapStringW
LCMapStringA
HeapSize
HeapReAlloc
GetCPInfo
GetOEMCP
GetACP
HeapAlloc
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
WriteFile
GetEnvironmentStringsW
GetLastError
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapFree
VirtualFree
GetProfileStringA
GetPrivateProfileStringA
GetProcAddress
FreeLibrary
ExpandEnvironmentStringsA
lstrlenA
lstrcpyA
LoadLibraryA
lstrcmpiA
GetVersionExA
LocalAlloc
TlsAlloc
VirtualProtect
InterlockedExchange
GetCommandLineA
HeapCreate
HeapDestroy
GetModuleFileNameA
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleHandleA
RtlUnwind
user32
SendMessageA
GetWindowLongA
GetDlgItem
DestroyWindow
SetTimer
ShowWindow
SetWindowTextA
DispatchMessageA
TranslateMessage
CharPrevW
CharNextW
SetWindowLongA
EndDialog
EnableWindow
wsprintfA
LoadStringA
CreateDialogParamA
CharPrevA
GetDlgItemTextA
SetDlgItemTextA
GetParent
MessageBoxA
KillTimer
PeekMessageA
advapi32
RegEnumKeyExW
RegEnumValueW
RegDeleteKeyW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegEnumKeyExA
RegCreateKeyExW
ole32
CoCreateInstance
CoGetMalloc
CoTaskMemAlloc
CLSIDFromString
CoTaskMemFree
CoInitializeEx
StringFromGUID2
CoTaskMemRealloc
Sections
.text Size: 84KB - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 52KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ