Static task
static1
Behavioral task
behavioral1
Sample
f4dc2962f6890ae4aec211343aa710b2_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f4dc2962f6890ae4aec211343aa710b2_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f4dc2962f6890ae4aec211343aa710b2_JaffaCakes118
-
Size
98KB
-
MD5
f4dc2962f6890ae4aec211343aa710b2
-
SHA1
691b794db54040f504ba07302cf52cbe66c26728
-
SHA256
5bb4b7c3c56f770fbfe87cb54baa78b79a130117b1b86d3f07048f85623f1545
-
SHA512
9d884d93b06321fc0ebd330ddf4c28b60aafbdaa7986096b834753497fca6632edb736c5980aae7e3ee05be085495304f10422199f986d77ce841bf09b8f3a21
-
SSDEEP
3072:8ugyXoHQEMbcqz9SonqH56+TA0gpFdohwkG:8bHvMVZSxHwGA0gpFdoh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f4dc2962f6890ae4aec211343aa710b2_JaffaCakes118
Files
-
f4dc2962f6890ae4aec211343aa710b2_JaffaCakes118.dll windows:4 windows x86 arch:x86
8f14fb4c91aae51b2f10f1b6f57b5afa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
CloseServiceHandle
GetUserNameA
OpenServiceA
QueryServiceStatus
RegQueryValueExA
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
UnlockServiceDatabase
kernel32
AddAtomA
CloseHandle
CompareStringA
CreateDirectoryA
CreateEventA
CreateFileA
CreateMutexA
CreateProcessA
CreateThread
DeleteAtom
DeleteFileA
EnterCriticalSection
ExitProcess
FindClose
FindResourceA
FreeEnvironmentStringsA
GetCPInfo
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsA
GetEnvironmentVariableA
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetThreadLocale
GetTickCount
GetUserDefaultLCID
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalHandle
GlobalReAlloc
GlobalUnlock
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
IsBadReadPtr
IsValidLocale
LCMapStringA
LeaveCriticalSection
LocalAlloc
LocalFree
LockResource
Module32First
MoveFileExA
MulDiv
MultiByteToWideChar
OpenEventA
OpenProcess
QueryPerformanceCounter
ReadFile
ReadProcessMemory
RemoveDirectoryA
ResetEvent
RtlUnwind
SearchPathA
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableA
SetFileTime
SetLastError
SetUnhandledExceptionFilter
Sleep
SuspendThread
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
WaitForSingleObject
lstrcmpiA
lstrcpynA
ole32
CLSIDFromProgID
CoTaskMemFree
CreateStreamOnHGlobal
user32
CopyRect
DestroyIcon
DispatchMessageA
EnableMenuItem
GetClientRect
GetDesktopWindow
GetFocus
GetSysColor
GetSystemMenu
GetWindowLongA
GetWindowPlacement
GetWindowRect
InflateRect
KillTimer
LoadBitmapA
LoadIconA
MessageBoxA
OffsetRect
PtInRect
RegisterWindowMessageA
SetMenu
SetTimer
SetWindowTextA
ShowWindow
UnhookWindowsHookEx
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
CODE Size: 51KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
BSS Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CRT Size: 39KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ