Static task
static1
Behavioral task
behavioral1
Sample
e0c84c34fce18d0b678a322b1e11ebad_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e0c84c34fce18d0b678a322b1e11ebad_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
e0c84c34fce18d0b678a322b1e11ebad_JaffaCakes118
-
Size
107KB
-
MD5
e0c84c34fce18d0b678a322b1e11ebad
-
SHA1
bd8dd97fa1bef89c2daffd4087a30592013ff863
-
SHA256
7d508817c9680e214dea7814e901c8a5d43c5c6f6373f7155c209f9aaef8321b
-
SHA512
54b9907a93aea57dfc48ca13c7b14424ca9dacee59c9fbdfbc9b8c20945d7cf625b00103ae68ed45b94304282f9c23ccf05edc76bd88c108c73851f4b4f39434
-
SSDEEP
1536:zAekDDHKWPnp2Nav5BsxMFLfctn2RHxfk5rAs/hiJjcN3qG2q3yKQtoKccNewfAf:z0/bnAo/LKoRr2kjcl/2ylQtoKcw3fy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e0c84c34fce18d0b678a322b1e11ebad_JaffaCakes118
Files
-
e0c84c34fce18d0b678a322b1e11ebad_JaffaCakes118.dll windows:4 windows x86 arch:x86
e524f4fb8f9b23ee9986ee21b1a333ca
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpyA
CloseHandle
WaitForSingleObjectEx
CreateProcessA
GetPrivateProfileIntA
OutputDebugStringA
DeleteFileA
MoveFileA
CreateThread
GlobalFree
lstrcmpA
GlobalAlloc
CreateMutexA
ReleaseMutex
lstrcmpiA
ExitProcess
GetModuleHandleA
GetLocaleInfoA
InterlockedExchange
InterlockedCompareExchange
Sleep
LocalAlloc
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
VirtualAlloc
HeapAlloc
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
GetStringTypeW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
HeapFree
VirtualFree
lstrcpynA
SetFileAttributesA
lstrcatA
GetFileAttributesA
lstrlenA
GetStartupInfoA
FormatMessageW
LocalFree
GetProcessHeap
GetProcAddress
LoadLibraryW
FreeLibrary
ReadConsoleW
GetConsoleMode
ReadFile
DisableThreadLibraryCalls
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
lstrlenW
VirtualProtect
GetStringTypeA
GetCommandLineA
RtlUnwind
GetVersion
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
user32
LoadStringA
GetWindowRect
PostMessageA
GetParent
ExitWindowsEx
MessageBoxA
ReleaseDC
DrawTextA
GetDC
LoadBitmapA
GetSysColor
SetWindowPos
GetSystemMetrics
FindWindowA
GetClassNameA
wsprintfA
DialogBoxParamA
SetForegroundWindow
SetCursor
LoadCursorA
LoadIconA
SendMessageA
GetWindowTextA
advapi32
RegCloseKey
RegEnumKeyA
RegFlushKey
RegQueryInfoKeyA
RegQueryValueA
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
RegEnumValueA
RegOpenKeyA
RegDeleteValueA
gdi32
CreateSolidBrush
CreateFontIndirectA
GetTextExtentPointA
GetDeviceCaps
SelectObject
ExtTextOutA
CreateCompatibleDC
GetObjectA
BitBlt
DeleteObject
Sections
.text Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ