Static task
static1
Behavioral task
behavioral1
Sample
10d9c5fd10c492e4e971baf195ef9266_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
10d9c5fd10c492e4e971baf195ef9266_JaffaCakes118.dll
Resource
win10v2004-20240910-en
General
-
Target
10d9c5fd10c492e4e971baf195ef9266_JaffaCakes118
-
Size
160KB
-
MD5
10d9c5fd10c492e4e971baf195ef9266
-
SHA1
ea7480303ecaeceab3c0855a8d09d5ce5cdaa319
-
SHA256
892abc54d877f36d46e409f1541ce268ccf90329b01ab16cff9e5614ad3c662c
-
SHA512
294aa033775b01d8c339942d442210479f622245733ba1dfc37eb078f256690d0bffb3311512b28ed60f0ff1b1bc01058c89c302396c7a0846fe9511b820e356
-
SSDEEP
3072:fhMnCZ9ae0bW940JdAmqQ5bQnglMMqqDLy/JhmGTWp41AJx/H:fCnsxvJX5AKqqDLujmGTWcAD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 10d9c5fd10c492e4e971baf195ef9266_JaffaCakes118
Files
-
10d9c5fd10c492e4e971baf195ef9266_JaffaCakes118.dll windows:4 windows x86 arch:x86
e4ce44af32498c053a880d48c278d340
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FindClose
FindFirstFileA
UnmapViewOfFile
lstrcmpA
MapViewOfFile
CloseHandle
CreateFileMappingA
GetFileSize
CreateFileA
lstrcatA
InterlockedDecrement
GetFileAttributesA
GetTimeZoneInformation
FindNextFileA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsFree
TerminateProcess
ExitProcess
LocalFree
GetCurrentProcess
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WaitForSingleObjectEx
CancelWaitableTimer
GetCommandLineW
GetDriveTypeW
GetConsoleOutputCP
CreateEventW
CreateWaitableTimerW
GetConsoleMode
SetConsoleMode
ReadConsoleW
WaitForSingleObject
FormatMessageW
GetStdHandle
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterW
SetConsoleCursorPosition
SetEvent
lstrcpynA
Sleep
GetModuleHandleW
InterlockedCompareExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrlenW
lstrcmpiW
GetModuleFileNameW
InterlockedIncrement
GetVersionExW
VirtualAlloc
VirtualQuery
MultiByteToWideChar
lstrcpyW
lstrcpynW
LoadLibraryW
lstrcatW
GetFileAttributesW
GetLocaleInfoA
GetStringTypeW
GetSystemInfo
GetStringTypeA
LCMapStringW
LCMapStringA
HeapSize
HeapReAlloc
GetCPInfo
GetOEMCP
GetACP
HeapAlloc
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
WriteFile
GetEnvironmentStringsW
GetLastError
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapFree
VirtualFree
GetProfileStringA
GetPrivateProfileStringA
GetProcAddress
FreeLibrary
ExpandEnvironmentStringsA
lstrlenA
lstrcpyA
LoadLibraryA
lstrcmpiA
GetVersionExA
LocalAlloc
TlsAlloc
VirtualProtect
InterlockedExchange
GetCommandLineA
HeapCreate
HeapDestroy
GetModuleFileNameA
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleHandleA
RtlUnwind
user32
SendMessageA
GetWindowLongA
GetDlgItem
DestroyWindow
SetTimer
ShowWindow
SetWindowTextA
DispatchMessageA
TranslateMessage
CharPrevW
CharNextW
SetWindowLongA
EndDialog
EnableWindow
wsprintfA
LoadStringA
CreateDialogParamA
CharPrevA
GetDlgItemTextA
SetDlgItemTextA
GetParent
MessageBoxA
KillTimer
PeekMessageA
advapi32
RegEnumKeyExW
RegEnumValueW
RegDeleteKeyW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegEnumKeyExA
RegCreateKeyExW
ole32
CoCreateInstance
CoGetMalloc
CoTaskMemAlloc
CLSIDFromString
CoTaskMemFree
CoInitializeEx
StringFromGUID2
CoTaskMemRealloc
Sections
.text Size: 84KB - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 52KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ