Static task
static1
Behavioral task
behavioral1
Sample
eb1f0b506d253c5a536b8e08a3cde901_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
eb1f0b506d253c5a536b8e08a3cde901_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
eb1f0b506d253c5a536b8e08a3cde901_JaffaCakes118
-
Size
23KB
-
MD5
eb1f0b506d253c5a536b8e08a3cde901
-
SHA1
c0038b5c14b3ca7933f855810d96330ff9e4ead7
-
SHA256
ee2e1f2033398b7207205f6dad8d5772b9c1fabb76dcbc43bf918fdb55a0a029
-
SHA512
965a30b17dd5b88fb6291c03c8d7ab26e8088fa77a81d9205dca90f9684ae6abcf81159811e1bfd305a6520515b7cf4d6106023198fd8e2614fc4adcb135f771
-
SSDEEP
384:NQ5NgKSr0xCpKejVqKy6mTXuMUfuDignuvUjIEa5x1GP2MbVLqGfQ4:6S4x8qKPMuADRJcEUm0GfQ4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb1f0b506d253c5a536b8e08a3cde901_JaffaCakes118
Files
-
eb1f0b506d253c5a536b8e08a3cde901_JaffaCakes118.dll windows:4 windows x86 arch:x86
c9c351d7a69673d6e20eee8c712604eb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetPrivateProfileStringA
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
LoadLibraryA
ReadProcessMemory
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
CloseHandle
InitializeCriticalSection
Process32Next
Process32First
CreateToolhelp32Snapshot
WriteProcessMemory
IsBadReadPtr
GetModuleHandleA
GetCurrentProcess
GetCurrentThreadId
VirtualProtectEx
GetModuleFileNameA
CreateThread
TerminateThread
GetCurrentProcessId
CreateMutexA
GetLastError
Sleep
GetComputerNameA
GetCurrentThread
user32
GetForegroundWindow
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetWindowTextA
FindWindowA
GetWindowThreadProcessId
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
msvcrt
strncpy
_strlwr
_adjust_fdiv
malloc
_initterm
free
sscanf
??3@YAXPAX@Z
fopen
fread
memcpy
sprintf
??2@YAPAXI@Z
strlen
strcat
strcpy
strrchr
memset
strstr
strchr
_stricmp
strcmp
wcslen
fclose
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 153B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ