Static task
static1
Behavioral task
behavioral1
Sample
13f9ad5ba556b7f133625c8cdc8a0968_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
13f9ad5ba556b7f133625c8cdc8a0968_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
13f9ad5ba556b7f133625c8cdc8a0968_JaffaCakes118
-
Size
100KB
-
MD5
13f9ad5ba556b7f133625c8cdc8a0968
-
SHA1
4be86cd980b16110656c5bd81ab3e7525d41945a
-
SHA256
18f7e1eb51f3dd9498a9f809be79f308c910054ee70611864f791e9c8203bc22
-
SHA512
7f5f7c8c16e8f5581ed16e9124ff564278b800526f66d7b2ca56eb58f9a29afe2a3c35404e1d1946afd93fb8a1f37c1273ba14738c35a3ed8cdd6c27d0229865
-
SSDEEP
3072:9v1ubk7PNZdge3lXZDy0IqkwkLQ1HszIkD:9vIbk7DdBVXZDJRYM1MF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 13f9ad5ba556b7f133625c8cdc8a0968_JaffaCakes118
Files
-
13f9ad5ba556b7f133625c8cdc8a0968_JaffaCakes118.dll windows:4 windows x86 arch:x86
bd19e2287ce3c8e77de5b0c062ea7849
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
MapViewOfFileEx
CreateFileMappingW
CreateFileW
Sleep
CreateThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetProcessHeap
HeapFree
lstrcpynA
GetModuleFileNameA
lstrlenW
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
CloseHandle
lstrlenA
FormatMessageA
lstrcatA
lstrcpyA
FindClose
FindNextFileA
GetTimeZoneInformation
DisableThreadLibraryCalls
FreeLibrary
GetProcAddress
LoadLibraryA
SetFilePointer
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetEndOfFile
WideCharToMultiByte
MultiByteToWideChar
SetLastError
GetTickCount
GetLocalTime
HeapDestroy
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
LocalFree
LocalAlloc
VirtualProtect
GlobalFree
GetCommandLineA
GetCurrentThread
GlobalAlloc
user32
IsWindow
CharPrevA
LoadStringA
GetClientRect
wsprintfA
advapi32
RegCloseKey
RegQueryValueExA
RegSetValueExA
FreeSid
RegSetValueExW
GetSecurityDescriptorLength
OpenThreadToken
SetThreadToken
RevertToSelf
RegCreateKeyExA
ole32
CLSIDFromString
CoCreateInstance
CoTaskMemFree
msvcr71
atoi
__dllonexit
__CppXcptFilter
_adjust_fdiv
malloc
_initterm
free
isdigit
strchr
_except_handler3
strrchr
_vsnprintf
_snprintf
_ultoa
_onexit
fclose
strncmp
wcslen
isspace
fprintf
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ