acxEventWan
Static task
static1
Behavioral task
behavioral1
Sample
f5f449994f165dc1e7a5053610b05395_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f5f449994f165dc1e7a5053610b05395_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f5f449994f165dc1e7a5053610b05395_JaffaCakes118
-
Size
156KB
-
MD5
f5f449994f165dc1e7a5053610b05395
-
SHA1
8445eace2e4249625665f83481448494ecfd9498
-
SHA256
f3cb1952e8665ab7aa94cd101a5e7ec5222216031f17af4b70d0a671f0cfd67a
-
SHA512
81eb21019b0600b1e44fb1a754cb1e67663058e85ef8a7a46ecbed019c31e70cd7ead344f99f8a767faa3beae4105ebdb05f29977c341ed16fc9fe715182deec
-
SSDEEP
3072:PiH+CwNMZ6/BGIJYob4TK72L49onX9alyAuFMw+ChbYuFjys:6dwNGkBGIJYo2L8iaE1+Cz5y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f5f449994f165dc1e7a5053610b05395_JaffaCakes118
Files
-
f5f449994f165dc1e7a5053610b05395_JaffaCakes118.dll windows:4 windows x86 arch:x86
c18e2c8c0e7175c469e04ecc7c56fc39
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
HeapAlloc
OpenEventA
HeapFree
CreateFileMappingA
MapViewOfFile
GetProcAddress
GetProcessHeap
LocalFree
GlobalAlloc
GetTickCount
SetLastError
WriteFile
CreateProcessA
OpenFileMappingA
InterlockedDecrement
WaitForSingleObject
TerminateProcess
LoadLibraryA
Sleep
InterlockedIncrement
GetModuleHandleA
CreateMutexW
CopyFileA
ReadProcessMemory
GetLastError
CreateFileA
GetCommandLineA
CloseHandle
GetComputerNameA
ExitProcess
EnterCriticalSection
CreateDirectoryA
InterlockedCompareExchange
CreateEventA
GlobalFree
GetCurrentProcess
UnmapViewOfFile
GetModuleFileNameA
LeaveCriticalSection
GetVolumeInformationA
WriteProcessMemory
ole32
CoInitialize
OleSetContainedObject
CoUninitialize
CoTaskMemAlloc
CoSetProxyBlanket
OleCreate
CoCreateInstance
CoCreateGuid
user32
ScreenToClient
CreateWindowExA
GetSystemMetrics
PostQuitMessage
UnhookWindowsHookEx
DispatchMessageA
SetWindowsHookExA
SetTimer
PeekMessageA
KillTimer
GetWindow
DestroyWindow
DefWindowProcA
GetMessageA
GetWindowLongA
GetCursorPos
ClientToScreen
GetWindowThreadProcessId
GetParent
FindWindowA
RegisterWindowMessageA
TranslateMessage
SetWindowLongA
GetClassNameA
SendMessageA
oleaut32
SysStringLen
SysAllocString
SysAllocStringLen
SysFreeString
shlwapi
UrlUnescapeW
StrStrIW
advapi32
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
DuplicateTokenEx
RegDeleteValueA
RegCreateKeyExA
SetTokenInformation
GetUserNameA
OpenProcessToken
RegCloseKey
shell32
SHGetFolderPathA
Exports
Exports
Sections
.text Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qqlxwvr Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ