Static task
static1
Behavioral task
behavioral1
Sample
ff65e14c9fc3b5983b669e41cb1435f8_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ff65e14c9fc3b5983b669e41cb1435f8_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ff65e14c9fc3b5983b669e41cb1435f8_JaffaCakes118
-
Size
77KB
-
MD5
ff65e14c9fc3b5983b669e41cb1435f8
-
SHA1
24a080f134cf22e58325cbc3323251a7a39d94bb
-
SHA256
c1d7988fa089ae7fd300997d7de2d56b28114fd19a3427d0239b2b6c41c28196
-
SHA512
26e873188fc1e7d8d4dde8b8320cdaca87d81830cfdc3b4ac30885d8fd3206b04acd567693b692c51bf793ec091e46a2775d760fbaddfdb7c008c0cdb3e5dd29
-
SSDEEP
1536:dEbgJ1NcZvwQjAJybMKZ4R1/5qEqxKMqbvwwqggt/9a:LJDivweAJynap50xKMwwwE9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff65e14c9fc3b5983b669e41cb1435f8_JaffaCakes118
Files
-
ff65e14c9fc3b5983b669e41cb1435f8_JaffaCakes118.dll windows:4 windows x86 arch:x86
30c4fd5a78304ac54b5b354121758240
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedExchange
GetTickCount
ReleaseMutex
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetLastError
SetEvent
WaitForSingleObject
Sleep
CloseHandle
ResetEvent
GetProcAddress
InterlockedCompareExchange
InterlockedIncrement
lstrlenA
lstrcpynW
FreeLibrary
DisableThreadLibraryCalls
GetCurrentProcessId
GetComputerNameW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
lstrcpyW
lstrlenW
DeviceIoControl
CreateFileA
LocalAlloc
LocalFree
VirtualProtect
GlobalFree
GetCommandLineA
LoadLibraryA
GlobalAlloc
user32
wsprintfA
CharPrevW
CharNextW
advapi32
RegQueryValueExW
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
CloseServiceHandle
StartServiceA
RegSetValueExA
ole32
CoRegisterClassObject
CoUninitialize
CoRevokeClassObject
CoRegisterPSClsid
rpcrt4
NdrClientCall2
RpcBindingFree
NdrDllGetClassObject
msvcr71
__dllonexit
__CppXcptFilter
_onexit
_adjust_fdiv
memmove
wcscpy
wcslen
_wcsicmp
_acmdln
exit
_ismbblead
_cexit
_except_handler3
_initterm
free
malloc
memset
memcpy
strstr
Sections
.text Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ