Static task
static1
Behavioral task
behavioral1
Sample
050f4f51418f632a7344c5a2db082454_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
050f4f51418f632a7344c5a2db082454_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
050f4f51418f632a7344c5a2db082454_JaffaCakes118
-
Size
212KB
-
MD5
050f4f51418f632a7344c5a2db082454
-
SHA1
f1d623c7356f09ec0decffa42a63eb45235844ea
-
SHA256
c56819e960176bf9d5e69358f0b41613bd8679b54db7c70ec97e6a3f1f9ad00a
-
SHA512
aa901bac05836eed815f6c31da077605a553c1061c6438bd6ad9a448e6af1c3629f9da4c3fa3612361dd3165dd7d2c3e68a1c2edd8f06ba809f4212ad5576eee
-
SSDEEP
6144:iwt5mIFuLvaZBmmtj1BP2GWAxqz0ZiuFt:9t5m2uLUBmmd1B+/Acz0h
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 050f4f51418f632a7344c5a2db082454_JaffaCakes118
Files
-
050f4f51418f632a7344c5a2db082454_JaffaCakes118.dll windows:4 windows x86 arch:x86
c6401e79376975e737c8fdfd91c804cb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetSystemDirectoryA
VirtualFree
VirtualQuery
GetLastError
GetModuleFileNameA
SetLastError
lstrlenA
LoadLibraryA
VirtualProtect
OpenProcess
TerminateProcess
GetModuleHandleA
GetProcAddress
CreateFileA
CreateFileMappingA
CloseHandle
MapViewOfFile
UnmapViewOfFile
VirtualAlloc
lstrcpyA
DeleteFileA
GetFileSize
GetComputerNameA
InterlockedExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
RtlUnwind
RaiseException
HeapFree
HeapAlloc
GetTimeZoneInformation
GetSystemTime
GetLocalTime
CreateThread
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
GetVersion
ExitProcess
GetCurrentProcess
HeapReAlloc
HeapSize
TlsAlloc
TlsFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
IsBadWritePtr
ReadFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
WriteFile
UnhandledExceptionFilter
InterlockedDecrement
InterlockedIncrement
FlushFileBuffers
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
Sleep
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
SetEndOfFile
LoadLibraryA
VirtualAlloc
GetModuleFileNameA
ExitProcess
user32
ShowWindow
EndDialog
FindWindowA
SetTimer
PostMessageA
DialogBoxParamA
MessageBoxA
RegisterHotKey
UnregisterHotKey
KillTimer
UpdateWindow
GetDesktopWindow
MoveWindow
MessageBoxA
msvcrt
_access
rename
isspace
isalnum
isalpha
fputs
isdigit
fgetwc
ungetwc
fputwc
_strlwr
Sections
.text Size: - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
irdata Size: 4KB - Virtual size: 265B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
code0 Size: - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
code1 Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
code2 Size: 196KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ