Static task
static1
Behavioral task
behavioral1
Sample
3800f0be71a041869872939af7655dc1_JaffaCakes118.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3800f0be71a041869872939af7655dc1_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
3800f0be71a041869872939af7655dc1_JaffaCakes118
-
Size
64KB
-
MD5
3800f0be71a041869872939af7655dc1
-
SHA1
bda4b5613d6667bec0dd3025989d48044eaaf802
-
SHA256
02cbc1aa4d48e4e9301c165e0d64aed15a5816fff3e18b3d1597386fdf7f141b
-
SHA512
b4add13e67295f5604a5a1a295c3c12338126e5985e08bdf047d17c4a23b16c567f04cd7ca679895fe21259da939699c51e02866c8658890522851be9a39ac22
-
SSDEEP
1536:/YsrMCO4CgJy43dzZAVd1lo6QTdJbxZT+o0WfxQTRXYGwu2omMNOFnAYB:sCO4Cgw45Jbrwmu2eNOhA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3800f0be71a041869872939af7655dc1_JaffaCakes118
Files
-
3800f0be71a041869872939af7655dc1_JaffaCakes118.dll windows:4 windows x86 arch:x86
cc68482f9439a06fa1a3173daf2340c9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcatA
lstrcpyA
OpenProcess
GetProcAddress
GetModuleHandleA
GetVersionExA
Process32Next
Process32First
CreateToolhelp32Snapshot
Sleep
ExitThread
TerminateThread
WaitForMultipleObjects
CreateMailslotA
GetModuleFileNameA
GetLastError
WaitForSingleObject
IsBadReadPtr
ReadFile
lstrlenA
GetSystemDirectoryA
CreateDirectoryA
GetTickCount
GetTempFileNameA
SetFilePointer
GetFileAttributesA
DeleteFileA
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
LoadLibraryA
ReleaseMutex
GetModuleHandleW
CreateEventA
CreateMutexW
MultiByteToWideChar
CreateThread
FindNextFileA
FindFirstFileA
lstrcmpA
CompareStringA
SetFileAttributesA
GetCurrentDirectoryA
FindClose
ResetEvent
CreateFileA
WriteFile
CloseHandle
SetEndOfFile
SetEvent
user32
wsprintfA
GetForegroundWindow
advapi32
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
RegNotifyChangeKeyValue
RegCreateKeyExA
RegSetValueExA
CreateProcessAsUserA
InitializeSecurityDescriptor
CryptDeriveKey
CryptHashData
RegOpenCurrentUser
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RevertToSelf
CryptCreateHash
CryptAcquireContextA
CryptDecrypt
CryptEncrypt
iphlpapi
GetAdaptersInfo
shell32
SHGetFolderPathA
Sections
.text Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ