Static task
static1
Behavioral task
behavioral1
Sample
2e9980cdf882377b363253c55bb4030e_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2e9980cdf882377b363253c55bb4030e_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
2e9980cdf882377b363253c55bb4030e_JaffaCakes118
-
Size
31KB
-
MD5
2e9980cdf882377b363253c55bb4030e
-
SHA1
31e2c47b93148166ac2f1cfb9729d852e0ac5382
-
SHA256
f07b0172a64af7e798bc953cfebed6d2bdd2dbfc5fa852e4da4ae0d5ffb03007
-
SHA512
f9f7cf53c78887fb90087a3d426d6b644b6f6f61e88abf34515629e46698ecb2044fe6b59adc7a05f2c68d6c3feab36ed8cd2da284ff5a3da0b61810199bfeaa
-
SSDEEP
768:1jPjVCGp4Ffu9Y7VHQYIPVy1VH0zoRrqMNl+UnhXhhUvTzC:1jPjiHQYI41VQMNcUn3hUvq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2e9980cdf882377b363253c55bb4030e_JaffaCakes118
Files
-
2e9980cdf882377b363253c55bb4030e_JaffaCakes118.dll windows:4 windows x86 arch:x86
7c8dd7e898ef9e251b65ab4c3d3eef34
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpyA
GetVersionExA
DeleteFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
Sleep
ExitThread
TerminateThread
WaitForMultipleObjects
lstrcatA
CreateMailslotA
GetModuleFileNameA
WaitForSingleObject
IsBadReadPtr
ReadFile
lstrlenA
GetSystemDirectoryA
CreateDirectoryA
GetTickCount
GetTempFileNameA
GetFileAttributesA
GetCurrentProcessId
GetLastError
CloseHandle
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
ReleaseMutex
CreateEventA
CreateMutexA
CreateThread
OpenProcess
lstrcmpA
ResetEvent
CompareStringA
GetConsoleCP
GetCurrentThreadId
CreateFileA
WriteFile
SetEndOfFile
SetFilePointer
SetEvent
user32
CharUpperA
wsprintfA
wininet
InternetOpenA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
InternetCloseHandle
InternetConnectA
InternetGetConnectedState
iphlpapi
GetAdaptersInfo
advapi32
RegCloseKey
OpenProcessToken
CreateProcessAsUserA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExA
RegCreateKeyExA
RegNotifyChangeKeyValue
CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
CryptEncrypt
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptDecrypt
RegSetValueExA
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ