Static task
static1
Behavioral task
behavioral1
Sample
41b1b5561fee83eecb3384b4c10f8df9_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
41b1b5561fee83eecb3384b4c10f8df9_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
41b1b5561fee83eecb3384b4c10f8df9_JaffaCakes118
-
Size
112KB
-
MD5
41b1b5561fee83eecb3384b4c10f8df9
-
SHA1
3b00dfcc8fb5082631ef812fef94021be8c3a5db
-
SHA256
b804021e6535a2da52a34df20b980e35c966640b4a0b41a4433f379d6422b267
-
SHA512
5779f880a02f41b053741481c301519aad9dce019866d7162992a5b139db57458d16e1c69baee0e0d1734b3a46af9083bdc4e69d47332628774f2ee7517f56f0
-
SSDEEP
3072:QBb1IVLs05WNzmn+OT4EoL2KXBGfK/I8uxxX7qCoAGD37x:CI20okf3rfKuLy1D3F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 41b1b5561fee83eecb3384b4c10f8df9_JaffaCakes118
Files
-
41b1b5561fee83eecb3384b4c10f8df9_JaffaCakes118.dll windows:4 windows x86 arch:x86
06b269f5c00cabf4986f73faefb8d4cb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RaiseException
GlobalFree
ReleaseMutex
WaitForSingleObject
FreeLibrary
GetModuleHandleW
WideCharToMultiByte
lstrlenA
GetVersionExW
InterlockedDecrement
CreateEventW
ChangeTimerQueueTimer
SetCurrentDirectoryW
GetWindowsDirectoryW
CreateDirectoryW
GetComputerNameW
GetCurrentDirectoryW
MoveFileExW
UnregisterWait
LoadLibraryW
GetSystemInfo
DisableThreadLibraryCalls
GetProcAddress
OpenFileMappingW
MapViewOfFileEx
CreateFileMappingW
VirtualAlloc
UnmapViewOfFile
GetModuleFileNameA
GetProfileStringA
CreateFileA
InterlockedIncrement
VirtualProtect
IsDebuggerPresent
GetCommandLineA
user32
CheckDlgButton
IsDlgButtonChecked
ShowWindow
MessageBoxW
SendMessageW
GetParent
PostMessageW
SetWindowLongW
BringWindowToTop
SetForegroundWindow
GetDlgItem
GetWindowLongW
SetCursor
LoadCursorW
SetWindowTextW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
msvcrt
_initterm
_adjust_fdiv
_strcmpi
memcpy
tolower
strchr
_strnicmp
strrchr
__dllonexit
_lock
_onexit
_stricmp
isspace
memset
wcschr
malloc
_except_handler3
_wcsicmp
_amsg_exit
_XcptFilter
free
_callnewh
Sections
.text Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ