Static task
static1
Behavioral task
behavioral1
Sample
e2c86087acd17ee3179b8ce41e1d3ef5_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
e2c86087acd17ee3179b8ce41e1d3ef5_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
e2c86087acd17ee3179b8ce41e1d3ef5_JaffaCakes118
-
Size
759KB
-
MD5
e2c86087acd17ee3179b8ce41e1d3ef5
-
SHA1
30c47e415ceb7af6ba33334bcf3942f1118c198f
-
SHA256
4b870b0ba5cdfd4396cb25d6096790344c1a9f8f75c56f276da59f74df2a9c88
-
SHA512
18dd25ab39b007534406a0788b0620163e336dc106809d0ad45c81d5916017a63b8934a13d67e9e1a945b2e05b659b270f26af24dbd6c4a41eeb108b2f87516f
-
SSDEEP
192:mpV90W01wyORDnkeM3gjSSnbllrqX7ZDAZfxMWUMAw30T77+QPbYe2vD7jVD1pM8:mpV9Rw5l3+Xnb6oMF4wvNiD7jVYDKAuB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e2c86087acd17ee3179b8ce41e1d3ef5_JaffaCakes118
Files
-
e2c86087acd17ee3179b8ce41e1d3ef5_JaffaCakes118.dll windows:4 windows x86 arch:x86
80f31b92b8d71e314f6a240668681f25
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
SetEvent
ReadFile
GetFileSize
CreateFileA
GetCurrentProcessId
GetTickCount
SetFilePointer
HeapAlloc
GetProcessHeap
VirtualProtect
HeapFree
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
LoadLibraryA
GetCommandLineA
GetCurrentProcess
TerminateProcess
OpenEventA
CreateEventA
IsBadReadPtr
GetPrivateProfileSectionA
GetPrivateProfileIntA
GetPrivateProfileStringA
Sleep
CreateThread
user32
wsprintfA
BroadcastSystemMessageA
SetWindowsHookExA
CallNextHookEx
GetWindowThreadProcessId
FindWindowA
IsWindowVisible
GetWindowTextA
GetWindowLongA
FindWindowExA
wvsprintfA
advapi32
RegQueryValueExA
RegSetValueA
RegCreateKeyA
RegOpenKeyA
RegCloseKey
RegSetValueExA
msvcrt
strrchr
_strcmpi
_adjust_fdiv
_initterm
_strlwr
realloc
strcat
strncpy
memset
strlen
strncat
strcpy
strchr
atoi
strcmp
memcpy
malloc
free
strstr
sprintf
_except_handler3
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ