Static task
static1
Behavioral task
behavioral1
Sample
2e0aa0abacbc7ab55da53f2a52198a1d_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2e0aa0abacbc7ab55da53f2a52198a1d_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
2e0aa0abacbc7ab55da53f2a52198a1d_JaffaCakes118
-
Size
56KB
-
MD5
2e0aa0abacbc7ab55da53f2a52198a1d
-
SHA1
b22ce48304c465f19c89dc65fd0195603aad541d
-
SHA256
da83abc90b0bbae008d2522398ef086e379ef439c7ccf921e6dd295191d49e56
-
SHA512
a0a5ee107ac488bd3cdfcd11f052aad76ec37b847caf1aeaedd06f797ba79067852d6a90d5aa3029f865860d5fcf057ec76eec96b59b2ef0495958a4c663c9e2
-
SSDEEP
768:o6H3XTYIstsIxUNNtYr8YDTQi6r5GLYCz9CRenchlirazmwh4:NH3XMIstXxUuDTQi6NGFB5Mliu6v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2e0aa0abacbc7ab55da53f2a52198a1d_JaffaCakes118
Files
-
2e0aa0abacbc7ab55da53f2a52198a1d_JaffaCakes118.dll windows:4 windows x86 arch:x86
077a31001b35eb043b039c9b407c8a86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
SetFilePointer
CreateFileA
GetLastError
GetCurrentProcess
GetFileSize
VirtualQuery
ReadFile
WinExec
Process32Next
Process32First
CreateToolhelp32Snapshot
Sleep
GetVersionExA
ExitProcess
CreateMutexA
CreateThread
GetModuleFileNameA
OpenProcess
GetSystemDirectoryA
DeleteCriticalSection
SetHandleCount
TerminateProcess
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
RtlUnwind
GetCommandLineA
GetVersion
HeapFree
InitializeCriticalSection
CloseHandle
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
HeapCreate
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
IsBadWritePtr
VirtualFree
WriteFile
VirtualAlloc
HeapReAlloc
GetCPInfo
user32
SetForegroundWindow
ShowWindow
FindWindowA
EnableWindow
GetDlgItem
DialogBoxParamA
MessageBoxA
SendMessageA
SetDlgItemTextA
IsWindow
GetWindowTextA
PostMessageA
SetFocus
SetWindowTextA
EndDialog
GetWindowRect
WindowFromPoint
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSetValueExA
RegQueryValueExA
RegOpenKeyA
RegEnumKeyExA
psapi
EnumProcessModules
GetModuleFileNameExA
Sections
.text Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 728B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ