UnregisterDriveChangeCallback
Static task
static1
Behavioral task
behavioral1
Sample
0ee1d5fe64d3944c66da35ee1c3ab638_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0ee1d5fe64d3944c66da35ee1c3ab638_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0ee1d5fe64d3944c66da35ee1c3ab638_JaffaCakes118
-
Size
236KB
-
MD5
0ee1d5fe64d3944c66da35ee1c3ab638
-
SHA1
6d232ac68ce7a841977fbbe474f09da2c46d40ed
-
SHA256
70c8c2dd5002f511a6405f605bd8a930c76ade75c13157d700591ca6f088e12b
-
SHA512
f339789b90c0677154bceda5bf179f73900188f965cab589148ae0af05b9d0b28fc91d0dd489765e5ec67b4917021af0d252e33194943721d47543b0ac4322fc
-
SSDEEP
3072:gVb1dri6/CiXCW1GJm0Y8w+OypEWLRMnIAM50repEFe5fk7tQYIfIshfvLZ1J3B:C7tCuCUG21+ONWKIAY3S7t/9yLFB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ee1d5fe64d3944c66da35ee1c3ab638_JaffaCakes118
Files
-
0ee1d5fe64d3944c66da35ee1c3ab638_JaffaCakes118.dll windows:4 windows x86 arch:x86
055c0b9253fb5ee9232cccfa1a8b196c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CompareStringW
CreateFileA
DeviceIoControl
ExitProcess
FatalAppExitA
GetACP
GetCommandLineA
GetCurrentProcess
GetEnvironmentStringsA
GetEnvironmentVariableA
GetLocaleInfoA
GetLocaleInfoW
GetModuleHandleA
GetProcessHeap
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetThreadContext
GetVersionExA
HeapAlloc
HeapCreate
InterlockedDecrement
LeaveCriticalSection
LocalFree
MapViewOfFile
RtlUnwind
SetConsoleCtrlHandler
SetHandleCount
SizeofResource
WaitForSingleObject
lstrcatA
lstrcmpiA
lstrcpyA
lstrlenA
advapi32
GetExplicitEntriesFromAclW
OpenSCManagerW
RegSetValueExW
CryptEncrypt
msvcrt
wcscat
printf
exit
_exit
_except_handler3
__getmainargs
__p__commode
__set_app_type
ole32
CoSetCancelObject
CoAddRefServerProcess
CreateFileMoniker
ddraw
GetDDSurfaceLocal
DirectDrawEnumerateExA
DDInternalLock
GetSurfaceFromDC
DirectDrawEnumerateExW
crypt32
CryptVerifyDetachedMessageHash
Exports
Exports
Sections
.text Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 96KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ