Static task
static1
Behavioral task
behavioral1
Sample
0e97b1b56f118bb1040b2c742abfa1dd_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0e97b1b56f118bb1040b2c742abfa1dd_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0e97b1b56f118bb1040b2c742abfa1dd_JaffaCakes118
-
Size
348KB
-
MD5
0e97b1b56f118bb1040b2c742abfa1dd
-
SHA1
76120085e3c0faec3b73f4d5bfbb2b002c1a383c
-
SHA256
a5754e6ef40687fe2c349fb39d3a4b33aee7c89b935260feadd603094b7d4d1b
-
SHA512
3d3fb6370bdec98f5d097182102c6c2843c4b6ae1d78730642e70057bf3d32e9d48918e15a89bed77401548edf3cd227e938d0393a8f5a0d6879aad8bb12fb9b
-
SSDEEP
6144:1+1Z6hJBWpX9didqqLzPzss2fQPUbmb9LgibJF2JsjQ60:1WZ6vBWpX9didqqLrzsRfQMbmJLZb/2x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e97b1b56f118bb1040b2c742abfa1dd_JaffaCakes118
Files
-
0e97b1b56f118bb1040b2c742abfa1dd_JaffaCakes118.dll windows:4 windows x86 arch:x86
4de06f8bf956724ea613c7358add8e68
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
GetTickCount
LeaveCriticalSection
EnterCriticalSection
Sleep
FindClose
FindNextFileA
FindFirstFileA
SetCurrentDirectoryA
TerminateThread
WaitForSingleObject
SuspendThread
ResumeThread
CreateFileMappingA
LocalFree
FormatMessageA
GetLastError
CreateFileA
CreateDirectoryA
UnmapViewOfFile
MapViewOfFile
SetEndOfFile
LoadLibraryA
GetOEMCP
GetACP
SetStdHandle
IsBadCodePtr
GetStringTypeW
GetStringTypeA
FlushFileBuffers
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
WriteFile
SetUnhandledExceptionFilter
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
WideCharToMultiByte
RtlUnwind
HeapFree
HeapAlloc
IsBadReadPtr
GetTimeZoneInformation
GetSystemTime
GetLocalTime
RaiseException
CreateThread
GetCurrentThreadId
TlsSetValue
ExitThread
GetCommandLineA
GetVersion
HeapReAlloc
ExitProcess
LCMapStringA
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
TerminateProcess
GetCurrentProcess
HeapSize
ReadFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
GetProcAddress
SetEnvironmentVariableA
ws2_32
closesocket
htonl
bind
listen
accept
ioctlsocket
select
__WSAFDIsSet
ntohs
socket
htons
inet_addr
gethostbyname
connect
WSACleanup
WSAStartup
send
recv
inet_ntoa
WSAGetLastError
Sections
.text Size: 256KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 40KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE