RInit2
Static task
static1
Behavioral task
behavioral1
Sample
e94c08b22b75a0b6cbd2e47142b747ae_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e94c08b22b75a0b6cbd2e47142b747ae_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
e94c08b22b75a0b6cbd2e47142b747ae_JaffaCakes118
-
Size
33KB
-
MD5
e94c08b22b75a0b6cbd2e47142b747ae
-
SHA1
b481f1f86c4b569bae84fd288832b061c3f556a6
-
SHA256
4ffb377edfcf3aeda1c211253adbe0e76c286359fa09ec375aa60236a10e0206
-
SHA512
b9a306de60e5cac55b12c5f7ca838ea92b1dd35786f6aff278ef3f9b0711a5c5628d9101e9b6df5aa62d45bc50e1febca622caddd3d0f5c94dd400ee2fcfa8f0
-
SSDEEP
768:qCNqjqkJyMdG5mKGFIFcc0Z/xBNkvDYLOpIbFID3WW3Mtrc7j4V0Pw8tfU+qG7HV:ngqkJyMdG5mKGFIFcc0Z/xBNkvDYLO6u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e94c08b22b75a0b6cbd2e47142b747ae_JaffaCakes118
Files
-
e94c08b22b75a0b6cbd2e47142b747ae_JaffaCakes118.dll windows:4 windows x86 arch:x86
7e7bc85fa4c4dd76babecf2a5cbecd0c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
inet_addr
gethostbyname
kernel32
CreateFileW
LocalAlloc
lstrcpyA
lstrcatA
GetComputerNameA
CloseHandle
WaitForSingleObject
CreateEventA
lstrlenA
GetTempPathA
lstrcmpiA
lstrcpynA
GlobalFree
GlobalAlloc
lstrcmpA
DeleteFileA
GetTempFileNameA
LocalFree
FindFirstFileA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
RtlUnwind
LoadLibraryA
GetLastError
GetTickCount
FindNextFileA
MoveFileA
Sleep
CreateThread
GetModuleFileNameA
VirtualQuery
FreeLibrary
SetEvent
ExitProcess
OpenEventA
MultiByteToWideChar
GetVersionExA
GetModuleHandleA
GetProcAddress
FindClose
CreateFileA
user32
SendMessageA
EnumWindows
GetWindowThreadProcessId
PostMessageA
CharLowerA
wsprintfA
advapi32
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegCreateKeyA
RegEnumValueA
RegSetValueExA
RegQueryValueExA
Exports
Exports
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ