Static task
static1
Behavioral task
behavioral1
Sample
eb8c645cc5315fc4368a079123be1801_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eb8c645cc5315fc4368a079123be1801_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
eb8c645cc5315fc4368a079123be1801_JaffaCakes118
-
Size
15KB
-
MD5
eb8c645cc5315fc4368a079123be1801
-
SHA1
1745c0d890ac41e581c2365c7f2bf7dbe86e6392
-
SHA256
5bed8760bdd895d9ecacfaaf6f89846cc4d63ef07aa745a83ff5f13d9725ff52
-
SHA512
0dddd5f2a3ee110787f06a494f4a9f4e2a5744b785bdd000a47e17556d106ce95f7d3beb5365e5a2f604b3b8592e4ea83219576293712abe37c4b6c8247abb90
-
SSDEEP
96:rONS6wGmM7xdzpLmQYMKLSQ3ftGuwt3dMeLXM1Ps2kHJXDQj9i2h7jorTJuGVXt5:rpydL8XF3/wt3dMPZKy9tPU1XVx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb8c645cc5315fc4368a079123be1801_JaffaCakes118
Files
-
eb8c645cc5315fc4368a079123be1801_JaffaCakes118.dll windows:4 windows x86 arch:x86
60c539e9d61d035e0055da0806f6d0a8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
ReleaseMutex
GetLastError
CreateMutexA
OpenProcess
GetCurrentProcessId
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
LoadLibraryA
WriteProcessMemory
VirtualAllocEx
FindClose
FindNextFileA
lstrcpynA
lstrcmpA
FindFirstFileA
VirtualProtectEx
Process32Next
ReadFile
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
GetSystemDirectoryA
CreateFileA
lstrcpyA
lstrlenA
IsBadStringPtrA
CreateThread
CloseHandle
Sleep
user32
GetForegroundWindow
wsprintfA
GetWindowThreadProcessId
EnumWindows
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
GetWindowTextA
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
shlwapi
StrStrIA
msvcrt
strcmp
_purecall
memset
strcpy
isprint
strstr
memcpy
memcmp
??3@YAXPAX@Z
??2@YAPAXI@Z
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
Sections
.bss Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: 1024B - Virtual size: 532B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ