Static task
static1
Behavioral task
behavioral1
Sample
55537d0e2d03b5973570334c81e80a65_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
55537d0e2d03b5973570334c81e80a65_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
55537d0e2d03b5973570334c81e80a65_JaffaCakes118
-
Size
48KB
-
MD5
55537d0e2d03b5973570334c81e80a65
-
SHA1
c71e1ac317ffe17a707166e63253a62787cc3fa0
-
SHA256
5d93e22e8d603aff69da67d5f38b9a7de97e493d960c79a80f75235ec99db7f2
-
SHA512
5e738298eec113cfd8be1a1fb9dd5adb904cde29edf674dedf06b481996d4e1a6fc3e06a6eb59704f9f43bc7b50330c04d873cf71639f16dbf81dfaa4931a6f4
-
SSDEEP
768:tTfCYIOP6jDoVe8dOBS3Krz9sMRquKOVsLv+y/1YXo9z:tjIjD0oyA91quVsLvRdAo5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 55537d0e2d03b5973570334c81e80a65_JaffaCakes118
Files
-
55537d0e2d03b5973570334c81e80a65_JaffaCakes118.dll windows:4 windows x86 arch:x86
2b27e745b022d3b2c3740f0c6a4eedf4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetStdHandle
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeW
GetStringTypeA
GetTickCount
lstrcmpiA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
HeapAlloc
WriteFile
LoadLibraryA
LCMapStringW
GetProcAddress
GetEnvironmentStringsW
GetEnvironmentStrings
VirtualAlloc
VirtualFree
LCMapStringA
CloseHandle
RtlUnwind
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
HeapDestroy
HeapCreate
HeapFree
SetHandleCount
GetFileType
GetStartupInfoA
GetModuleFileNameA
user32
LoadStringA
FindWindowA
SendMessageA
GetSystemMetrics
GetUpdateRect
GetProcessWindowStation
GetSysColorBrush
GetForegroundWindow
GetDC
GetSysColor
MessageBoxA
gdi32
Rectangle
CreateBitmap
shlwapi
StrRChrA
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
ole32
CoInitialize
CoTaskMemAlloc
CoUninitialize
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ