Static task
static1
Behavioral task
behavioral1
Sample
f8c8aac311ebbe56829930f04c71919c_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f8c8aac311ebbe56829930f04c71919c_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f8c8aac311ebbe56829930f04c71919c_JaffaCakes118
-
Size
818KB
-
MD5
f8c8aac311ebbe56829930f04c71919c
-
SHA1
db0c220e32258ef2cdeb2c540cce5df03925f488
-
SHA256
7a0f00e6b00c4209867e25fbb35a6cf5198cd16ccb45caf731521f145ed74619
-
SHA512
3c79fb61ae1fd8a0c750a0e15961461165f5f001d9113dac4f833ef750f239908be4b99644ab7cc8d5f9ae37d3654bfd289d1980d33cd364f801457c16b4162c
-
SSDEEP
24576:oq1FlN1xlPVc1ZQBQkoTjPCpKTbzMxaZE7mdirlA:3P9Pyz6DMPCMTbzdZEmX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f8c8aac311ebbe56829930f04c71919c_JaffaCakes118
Files
-
f8c8aac311ebbe56829930f04c71919c_JaffaCakes118.dll windows:4 windows x86 arch:x86
6529b14a6f88f1a043aad499c26ea2ac
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateFileA
GetPrivateProfileStringA
GetCurrentProcessId
IsBadReadPtr
GetProcAddress
LoadLibraryA
SetFilePointer
HeapAlloc
GetProcessHeap
VirtualProtect
ExitProcess
GetFileSize
GetModuleHandleA
GetCommandLineA
ReadFile
SetEvent
CloseHandle
GetModuleFileNameA
Sleep
GetCurrentProcess
TerminateProcess
OpenEventA
CreateEventA
CreateThread
user32
wsprintfA
wvsprintfA
FindWindowExA
BroadcastSystemMessageA
GetWindowTextA
IsWindowVisible
FindWindowA
CallNextHookEx
GetWindowThreadProcessId
GetWindowLongA
SetWindowsHookExA
advapi32
RegSetValueExA
RegSetValueA
RegCreateKeyA
RegOpenKeyA
RegCloseKey
RegQueryValueExA
msvcrt
_except_handler3
realloc
_initterm
_adjust_fdiv
_strcmpi
memcpy
strcmp
strcpy
strcat
strlen
free
strncpy
strchr
strstr
memset
malloc
strrchr
_strlwr
sprintf
netapi32
Netbios
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ