Static task
static1
Behavioral task
behavioral1
Sample
fc54895f35340b8e717e5e7615a51f7c_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fc54895f35340b8e717e5e7615a51f7c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fc54895f35340b8e717e5e7615a51f7c_JaffaCakes118
-
Size
81KB
-
MD5
fc54895f35340b8e717e5e7615a51f7c
-
SHA1
99122811e3c0180d92bdcac14255122e3f73079b
-
SHA256
d28984e237def156243e2881178e2fc7e726106a84a6eded71e3e1da6b65a7c2
-
SHA512
1c460331f4f451a0ca63188c669115684c62264dfec89e57c6a195f8409be022b7d588cd1505941595afb91589fe93471e5524c9cdbd56553fb62ebb9f268aa8
-
SSDEEP
1536:8qwLXXPhipjbpOn1waTlRMd6sicPJcPbvXOJG1LhbPttwQxIHIPNu:DwDpfnGaTu6ngiLhbPtWZWu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fc54895f35340b8e717e5e7615a51f7c_JaffaCakes118
Files
-
fc54895f35340b8e717e5e7615a51f7c_JaffaCakes118.dll windows:4 windows x86 arch:x86
528029ebb431fd9c08a8e710ecb50732
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedExchange
lstrlenW
OutputDebugStringA
GetDriveTypeA
GetVolumeInformationA
GetTempPathA
GetTempFileNameA
GetACP
WideCharToMultiByte
lstrlenA
Sleep
RaiseException
InterlockedIncrement
lstrcmpiW
MultiByteToWideChar
ReadFile
SetFilePointer
GetFileSize
SetFileTime
GetTickCount
InterlockedDecrement
GetProcessHeap
FindClose
FindNextFileW
VirtualProtect
FindFirstFileW
GetModuleFileNameW
CloseHandle
CreateFileW
GetCommandLineA
GetModuleHandleW
user32
DestroyWindow
DefWindowProcW
InvalidateRect
wsprintfW
advapi32
RegCreateKeyW
ControlService
RegDeleteKeyW
RegSetValueExW
RegCloseKey
RegSetValueW
ChangeServiceConfigW
OpenServiceW
QueryServiceStatus
CloseServiceHandle
StartServiceW
ole32
OleRegGetUserType
CoTaskMemAlloc
PropVariantClear
CoCreateInstance
StringFromGUID2
CoTaskMemFree
msvcrt
wcscpy
_adjust_fdiv
memmove
memcpy
_unlock
__dllonexit
_lock
_amsg_exit
memset
wcstoul
_initterm
malloc
free
_except_handler3
wcscat
wcslen
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ