Static task
static1
Behavioral task
behavioral1
Sample
f4dea0d7162c6c1280897b75a29cb39e_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f4dea0d7162c6c1280897b75a29cb39e_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f4dea0d7162c6c1280897b75a29cb39e_JaffaCakes118
-
Size
28KB
-
MD5
f4dea0d7162c6c1280897b75a29cb39e
-
SHA1
8974fe7939d6e622a45e314458b8342dc37f2a4f
-
SHA256
9fe173eda6f0aff9a961cb61386eef1d40cef924e69b7ca01aac05da84fe9937
-
SHA512
15b6b34cdd042edc44c6995e3f3e3cbbe473a180f68971b058ad674632304bea16cdc9d1f4e51d737d56e6876ddc4e756c2f7bcec84cd24e71c1a47e90a857e9
-
SSDEEP
384:Z6WwHVoqINoHI6uJIkTgT4r5XT+Wt/65+TDYnm:Doo6uJIkTgT4r5XTxt/uy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f4dea0d7162c6c1280897b75a29cb39e_JaffaCakes118
Files
-
f4dea0d7162c6c1280897b75a29cb39e_JaffaCakes118.dll windows:4 windows x86 arch:x86
078692981e6155ee2c3152d95234182e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
malloc
_adjust_fdiv
_initterm
free
memcmp
atoi
memcpy
strncpy
strchr
strcmp
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_itoa
_strlwr
kernel32
Sleep
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
CreateThread
lstrcmpA
lstrlenA
lstrcpyA
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
ExitProcess
Sections
.text Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 840B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 988B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ