Static task
static1
Behavioral task
behavioral1
Sample
f6d9feb5d5fd6e4361147dd45182ff40_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f6d9feb5d5fd6e4361147dd45182ff40_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f6d9feb5d5fd6e4361147dd45182ff40_JaffaCakes118
-
Size
96KB
-
MD5
f6d9feb5d5fd6e4361147dd45182ff40
-
SHA1
04e3d68d25306068a1e0c5fec3cfba04fb7fd0eb
-
SHA256
0af83c1377add64c27eb4434331a8acc7e13150656a7460857b17decdffde6d4
-
SHA512
e0fa44a8f0f8b2bf5f22853b593050ec1c2b3f30cc783f5a202a084229c6acc8edce7a56ce1db0f5dd367277a6dac7f6788566d549f99495305431f88d316dce
-
SSDEEP
1536:jVN/kiHjKiiOYu2Sld8wE1rDTCVT/kCA4UO3gaHYruDR4rb:jVKyKSCvwcOVT8COO3H9Rq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f6d9feb5d5fd6e4361147dd45182ff40_JaffaCakes118
Files
-
f6d9feb5d5fd6e4361147dd45182ff40_JaffaCakes118.dll windows:4 windows x86 arch:x86
9d4834e9b468ced45a0b2a3d6be14a60
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CreateThread
CreateEventW
HeapFree
ReadFileEx
GetOverlappedResult
DeviceIoControl
GetLastError
WaitForSingleObjectEx
SetThreadPriority
HeapDestroy
DeleteCriticalSection
GetProcessHeap
HeapCreate
DisableThreadLibraryCalls
InitializeCriticalSection
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
ExitThread
InterlockedIncrement
FormatMessageW
lstrlenW
RaiseException
lstrcmpiW
InterlockedDecrement
lstrcpyW
GetModuleFileNameW
lstrcpynW
FreeLibrary
MultiByteToWideChar
WaitForMultipleObjects
LocalAlloc
LocalFree
GetLocaleInfoA
lstrcatW
InterlockedCompareExchange
FreeResource
HeapAlloc
SetEvent
ResetEvent
EnterCriticalSection
LeaveCriticalSection
Sleep
WaitForSingleObject
GetCurrentProcess
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GlobalFree
VirtualProtect
GlobalAlloc
InterlockedExchange
GetCommandLineA
user32
SetWindowLongW
RegisterDeviceNotificationW
RegisterClassA
EndPaint
GetClientRect
UnregisterClassA
LoadCursorW
LoadIconW
CharNextW
LoadImageW
PostQuitMessage
RegisterClassW
CreateWindowExW
PeekMessageW
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
DefWindowProcW
GetWindowLongW
UnregisterDeviceNotification
DestroyWindow
BeginPaint
advapi32
RegDeleteKeyW
CloseServiceHandle
RegOpenKeyExW
RegDeleteValueW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegisterTraceGuidsW
UnregisterTraceGuids
ReportEventW
OpenServiceW
QueryServiceStatus
TraceMessage
gdi32
GetStockObject
ole32
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
CLSIDFromString
StringFromCLSID
rpcrt4
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingSetOption
RpcBindingSetAuthInfoW
RpcBindingFree
RpcStringBindingComposeW
msvcr71
_except_handler3
_initterm
_adjust_fdiv
wcscpy
_callnewh
malloc
swprintf
wcslen
wcscmp
_onexit
memcpy
_amsg_exit
memset
_XcptFilter
__CppXcptFilter
__dllonexit
free
Sections
.text Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ