Static task
static1
Behavioral task
behavioral1
Sample
f9a3fa3ea36cc525bce838761814e7f2_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f9a3fa3ea36cc525bce838761814e7f2_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f9a3fa3ea36cc525bce838761814e7f2_JaffaCakes118
-
Size
104KB
-
MD5
f9a3fa3ea36cc525bce838761814e7f2
-
SHA1
7bb1a3033f30be6934960a5b47ce4d94274723fc
-
SHA256
8e64acea1b7fd53e68734f43e177fb5a836fc9951345121837ce91ad7bb9fab3
-
SHA512
d7ee6884586965e1c654aa5e3e51640f47a4524c527ff716d120b086d983aa801849bc2675f6301a8809e4f734ccb6e0207a6bd507ad767d9b41e79f43da9895
-
SSDEEP
3072:v8vhYYJOwMwDjKltPsK3etNCJo61VCh0:vWhY9wMwysBwZ1gO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f9a3fa3ea36cc525bce838761814e7f2_JaffaCakes118
Files
-
f9a3fa3ea36cc525bce838761814e7f2_JaffaCakes118.dll windows:4 windows x86 arch:x86
52c54bef58b7cc8bfd348f50621dbf79
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualFree
SetHandleCount
GetFileType
GetStdHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
VirtualAlloc
CloseHandle
SetStdHandle
MoveFileExW
GetLastError
WideCharToMultiByte
GetComputerNameW
Sleep
FormatMessageW
LocalFree
lstrcatW
MultiByteToWideChar
lstrcpyW
lstrcmpiW
lstrcpynW
lstrlenW
TlsGetValue
SetLastError
TlsSetValue
GetCurrentThreadId
GetStartupInfoA
VirtualProtect
GlobalFree
GetCommandLineA
GetModuleFileNameW
GlobalAlloc
user32
CharNextW
wsprintfW
LoadStringW
advapi32
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegCreateKeyExW
ole32
ProgIDFromCLSID
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
rpcrt4
NdrDllRegisterProxy
msvcr71
_onexit
__CppXcptFilter
_adjust_fdiv
malloc
_initterm
free
__dllonexit
_except_handler3
Sections
.text Size: 52KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ