I
Static task
static1
Behavioral task
behavioral1
Sample
fa067db07c43e572ca5bcfee06b80f6e_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
fa067db07c43e572ca5bcfee06b80f6e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fa067db07c43e572ca5bcfee06b80f6e_JaffaCakes118
-
Size
684KB
-
MD5
fa067db07c43e572ca5bcfee06b80f6e
-
SHA1
b49fc13c1bbd63b67793096a9c387c0005c4c265
-
SHA256
1058fc5c7c7fd55ad19264a79df2f29c6d1b5b9fdbcd1ffde3802dc86490d4af
-
SHA512
1f8aaabe1f5b91066be7eb66191e705a7205d83f32a22440ff02fc1fbde72dff66d288f58f90ba2a8ac9a459f0fefa79a238399b2bcb4c5d8ad5864b7a351f7d
-
SSDEEP
12288:6OU/QJnCTKqEqOKKW39TSLvQRuvwDSpDrPhyn/IGfZyacKeo+uu3:g/ICdNKW39TSLvQR1CvGIGfZy9Ke+u3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa067db07c43e572ca5bcfee06b80f6e_JaffaCakes118
Files
-
fa067db07c43e572ca5bcfee06b80f6e_JaffaCakes118.dll windows:5 windows x86 arch:x86
b2bcc112be033b398a77939986ffce68
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
TlsSetValue
SetLastError
CloseHandle
GetLastError
WaitForSingleObject
CreateEventA
InterlockedIncrement
SetEvent
InterlockedDecrement
TlsGetValue
TlsAlloc
CreateIoCompletionPort
PostQueuedCompletionStatus
GetSystemInfo
DeleteCriticalSection
RaiseException
EnterCriticalSection
GetCurrentThreadId
InterlockedExchange
ResetEvent
GetQueuedCompletionStatus
InitializeCriticalSection
LeaveCriticalSection
lstrcmpiA
CreateThread
Sleep
GlobalFree
GlobalAlloc
IsBadReadPtr
lstrlenA
WriteFile
CreateFileA
WideCharToMultiByte
lstrlenW
UnmapViewOfFile
MapViewOfFile
DuplicateHandle
GetCurrentProcess
OpenProcess
TerminateThread
CreateFileMappingA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
CreateProcessA
GetWindowsDirectoryA
TerminateProcess
GetFileAttributesA
LocalFree
ReadFile
LocalAlloc
GetFileSize
SetFilePointer
FreeLibrary
LoadLibraryA
CreateDirectoryA
OpenMutexA
GetModuleFileNameA
CreateMutexA
GetTickCount
GetVolumeInformationA
GetComputerNameA
GetTempFileNameA
GetLocalTime
MoveFileExA
DeleteFileA
RemoveDirectoryA
GetShortPathNameA
FindClose
FindNextFileA
FindFirstFileA
OpenFileMappingA
VirtualQuery
VirtualProtect
GetCurrentProcessId
SetThreadPriority
GetThreadPriority
GetCurrentThread
DisableThreadLibraryCalls
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree
MultiByteToWideChar
WaitForMultipleObjects
GetDriveTypeA
GetLogicalDriveStringsA
OpenEventA
RtlUnwind
ExitThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetModuleHandleW
TlsFree
HeapSize
ExitProcess
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
Exports
Exports
Sections
.text Size: 233KB - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 401KB - Virtual size: 401KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE