Static task
static1
Behavioral task
behavioral1
Sample
035dbfb286490c2dc4bb858db341fd10_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
035dbfb286490c2dc4bb858db341fd10_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
035dbfb286490c2dc4bb858db341fd10_JaffaCakes118
-
Size
100KB
-
MD5
035dbfb286490c2dc4bb858db341fd10
-
SHA1
9b5a36fa5663ae53d87acae1b3341f9861092adc
-
SHA256
f67553e470fda1486cadc72f7aa10814cb8ec342b0bc8da3deaea76b4551cddb
-
SHA512
ca54fecfb3cf48b1e2ecd45f676713fd0a230905926e3a586b9a008bec21ed278a10e0980322bd3c3f3ad154d1a91e957467f5da7a41da3b3fa4b1cc2494cfdb
-
SSDEEP
1536:XYTz0oSuBF4U4WsMQSyL6yF5UDdC01j/s72DfDfVc21ZQzo+TR:noS0v54L6Q+dCC/v7Fjrk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 035dbfb286490c2dc4bb858db341fd10_JaffaCakes118
Files
-
035dbfb286490c2dc4bb858db341fd10_JaffaCakes118.dll windows:5 windows x86 arch:x86
2d5164f9818de1a4cb1b11b0d1e680cf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetTickCount
GetVersionExA
InterlockedDecrement
InterlockedIncrement
LoadLibraryExA
MultiByteToWideChar
OpenEventA
OpenProcess
QueryPerformanceCounter
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
SetEvent
SetUnhandledExceptionFilter
Sleep
TerminateProcess
UnhandledExceptionFilter
WideCharToMultiByte
lstrcatA
lstrcpyA
lstrcpynA
lstrlenA
GetSystemDirectoryA
GetModuleHandleA
GetModuleFileNameA
GetLastError
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetComputerNameA
FreeLibrary
CreateProcessA
CreateEventA
CompareStringA
CloseHandle
AddAtomA
LocalAlloc
CreateFileW
LoadLibraryA
GetProcAddress
SetCurrentDirectoryA
VirtualAlloc
user32
LoadCursorA
LoadIconW
LoadCursorW
GetSysColor
gdi32
SetBkColor
GetTextMetricsW
GetObjectW
GetMapMode
GetDeviceCaps
DeleteObject
DeleteDC
DPtoLP
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
BitBlt
GetStockObject
SetBkMode
SetMapMode
SetTextColor
StretchBlt
SelectObject
msvcrt
__getmainargs
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_adjust_fdiv
_controlfp
_initterm
_vsnwprintf
Sections
.ttt Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ttt7 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
.ttt6 Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 392B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ