Static task
static1
Behavioral task
behavioral1
Sample
f568ad835f9175b133ac70260dc9df50_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f568ad835f9175b133ac70260dc9df50_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f568ad835f9175b133ac70260dc9df50_JaffaCakes118
-
Size
22KB
-
MD5
f568ad835f9175b133ac70260dc9df50
-
SHA1
d5add69bbac5f7a80a8176d7fd9cb0f4d1909779
-
SHA256
f016cbf4dea4b4eab6e9aa6f3da2111d03a82d61931e08f0cc63322105f37e89
-
SHA512
7962b65519573f7ab13ac13bd15e2b7d2946b7619a74170e51dfdedac00c4fddf094166d20c1d718ed5cd793eeab47e05058d5fe0b80953af1388d63791a4d31
-
SSDEEP
384:xt4su76wSP59CcTXRzurmzdyJlNKGtdqZKfdF3I8qNpBiS:UsxwC7tzuvXqUfdxLS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f568ad835f9175b133ac70260dc9df50_JaffaCakes118
Files
-
f568ad835f9175b133ac70260dc9df50_JaffaCakes118.dll windows:4 windows x86 arch:x86
4e2e1498735ae7ced0e4a62fe0a3ee4e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WideCharToMultiByte
GetLastError
ReadFile
GetFileSize
CreateFileA
GetPrivateProfileStringA
SetFilePointer
GetProcAddress
HeapAlloc
GetProcessHeap
OutputDebugStringA
GetModuleHandleA
GetModuleFileNameA
Sleep
VirtualQueryEx
ReadProcessMemory
GetFileAttributesW
CloseHandle
GetTempPathA
GetCurrentProcessId
OpenProcess
TerminateProcess
GetCurrentProcess
LoadLibraryA
CreateThread
user32
wsprintfA
GetWindow
GetClassNameW
wininet
InternetCloseHandle
msvcrt
memset
malloc
strcat
sprintf
strlen
??3@YAXPAX@Z
wcscmp
??2@YAPAXI@Z
mbstowcs
_stricmp
strrchr
isprint
strncpy
strstr
_except_handler3
wcslen
wcsncat
wcscpy
wcsstr
exit
printf
strchr
strcmp
memcpy
fclose
fopen
_vsnprintf
free
_strcmpi
_strupr
strcpy
gdiplus
GdipGetImageEncodersSize
GdipDisposeImage
GdipSaveImageToFile
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
gdi32
CreateCompatibleDC
BitBlt
DeleteObject
CreateCompatibleBitmap
SelectObject
DeleteDC
GetDeviceCaps
CreateDCA
wsock32
WSAGetLastError
closesocket
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ