GOODBOY
Static task
static1
Behavioral task
behavioral1
Sample
ecc72b257b98c1c5e2f06fceaf419b6f_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ecc72b257b98c1c5e2f06fceaf419b6f_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
ecc72b257b98c1c5e2f06fceaf419b6f_JaffaCakes118
-
Size
18KB
-
MD5
ecc72b257b98c1c5e2f06fceaf419b6f
-
SHA1
5c43415188b2daf9937b0de8db7cb96ac8d4e457
-
SHA256
6117ed85bc09a8e9cac289b7a86eb91162fcad6aff3ae9d204c5517fb870b89d
-
SHA512
9bb41cfe55254169481a621a9c7bc3e227bcffcdce256f84750ea94bc7f562a9bd1efc5092c0527067a3a28775a46ccd429a4b28be9e8a2c9868ef4324a852d7
-
SSDEEP
384:gAgIk8Tx1KAdw3zGQyalKTGFROL/VbJHC7LNt:gAZovKavOL/VFC7LNt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ecc72b257b98c1c5e2f06fceaf419b6f_JaffaCakes118
Files
-
ecc72b257b98c1c5e2f06fceaf419b6f_JaffaCakes118.dll windows:4 windows x86 arch:x86
8b85a4a3a4cc91e1f66e82290f72b7c3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcess
Thread32Next
SuspendThread
LoadLibraryA
GetModuleHandleA
GetProcAddress
Thread32First
Process32Next
CloseHandle
Process32First
CreateToolhelp32Snapshot
ReadFile
ReadProcessMemory
Sleep
CreateProcessA
ExitThread
GetSystemDirectoryA
OutputDebugStringA
WriteProcessMemory
lstrcmpiA
CreateThread
user32
CallNextHookEx
TranslateMessage
GetMessageA
SetWindowsHookExA
DispatchMessageA
advapi32
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
msvcrt
free
_except_handler3
sprintf
malloc
wininet
HttpSendRequestW
InternetCloseHandle
HttpOpenRequestA
InternetConnectA
InternetOpenA
HttpSendRequestA
ws2_32
WSACleanup
closesocket
send
connect
gethostbyname
inet_addr
htons
socket
WSAStartup
Exports
Exports
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ