Static task
static1
Behavioral task
behavioral1
Sample
0aabb55eff3458c4fa43b1f133655594_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0aabb55eff3458c4fa43b1f133655594_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0aabb55eff3458c4fa43b1f133655594_JaffaCakes118
-
Size
490KB
-
MD5
0aabb55eff3458c4fa43b1f133655594
-
SHA1
250c8554a6f6379725443aa5684326d221dcf5aa
-
SHA256
999a1205c4cdb5668442209674b311c5af770166554e66fca0181781ec7ab21a
-
SHA512
34c0038a516f5173e65b21208a2cb55ec536a83c2a7322d6009ed4c4302d531b9553dc5c520376c5e4599ee025cd332e7aa365d704fd626934f9e0e4078561ce
-
SSDEEP
6144:dkAhU5QCr3yTppp1oJVYp9sJTxzz7wEkdmu1OU0cxfEO30EG6+8bsey:dkLQC+T3p1Y0+Pz7wEkdm0VEO3HCury
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0aabb55eff3458c4fa43b1f133655594_JaffaCakes118
Files
-
0aabb55eff3458c4fa43b1f133655594_JaffaCakes118.dll windows:6 windows x86 arch:x86
43858a672a5fdf2e3e555c4388a871ae
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
QueryPerformanceCounter
GlobalAlloc
GlobalLock
GlobalUnlock
DisableThreadLibraryCalls
CreateThread
GetTickCount
GetModuleHandleA
GetProcAddress
VirtualProtect
FreeLibraryAndExitThread
Sleep
VirtualQuery
GetModuleFileNameA
GetCurrentProcess
K32GetModuleInformation
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
QueryPerformanceFrequency
GetTickCount64
MultiByteToWideChar
GetPrivateProfileStringA
ResetEvent
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CloseHandle
CreateDirectoryA
InitializeSListHead
WritePrivateProfileStringA
user32
SetCursor
GetAsyncKeyState
CallWindowProcA
GetClipboardData
GetKeyState
CloseClipboard
OpenClipboard
FindWindowA
SetWindowLongA
EmptyClipboard
GetClientRect
SetClipboardData
shell32
SHGetFolderPathA
msvcp140
?uncaught_exception@std@@YA_NXZ
?_BADOFF@std@@3_JB
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
imm32
ImmSetCompositionWindow
ImmGetContext
vcruntime140
memchr
__std_terminate
memmove
__std_type_info_destroy_list
_except_handler4_common
_CxxThrowException
memset
__vcrt_InitializeCriticalSectionEx
memcpy
__CxxFrameHandler3
__std_exception_copy
strchr
__std_exception_destroy
_purecall
strstr
api-ms-win-crt-math-l1-1-0
_except1
_libm_sse2_pow_precise
_libm_sse2_exp_precise
_libm_sse2_sqrt_precise
ceil
floor
fmaxf
_libm_sse2_cos_precise
_CIfmod
_CIatan2
_libm_sse2_sin_precise
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
terminate
_errno
_wassert
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
fread
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fwrite
__stdio_common_vsprintf_s
_get_stream_buffer_pointers
__stdio_common_vsprintf
ftell
fputc
fopen
__acrt_iob_func
__stdio_common_vsscanf
fgetc
_wfopen
fflush
fclose
__stdio_common_vfprintf
fseek
api-ms-win-crt-convert-l1-1-0
atoi
strtol
atof
api-ms-win-crt-string-l1-1-0
_stricmp
strncpy
towlower
isprint
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_stat64i32
_unlock_file
Sections
.text Size: 412KB - Virtual size: 411KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ