Static task
static1
Behavioral task
behavioral1
Sample
f6fb0d12d2a2dcc461dcc74525502030_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f6fb0d12d2a2dcc461dcc74525502030_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f6fb0d12d2a2dcc461dcc74525502030_JaffaCakes118
-
Size
30KB
-
MD5
f6fb0d12d2a2dcc461dcc74525502030
-
SHA1
cc6bd342ead5899597ee82f51a3cb6461ad2c3b2
-
SHA256
c76d8c287f978489d7a53ea8429824915f244f730996103f3fe155fc074936f9
-
SHA512
51fd418bc014b3f299bba908a19528b74ffdd45e6428b7ebf0dc90f44db47461881b4f7e945479c2eb784740fb93423e1a5d3902e4aa412cc22f3217c5893391
-
SSDEEP
768:hVo2nittMAZ1gBFGkEwXDjBSIwDu2OJ7JiCB:YNttMIgfGkPyu8CB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f6fb0d12d2a2dcc461dcc74525502030_JaffaCakes118
Files
-
f6fb0d12d2a2dcc461dcc74525502030_JaffaCakes118.dll windows:4 windows x86 arch:x86
0954576c9f2915a42a275c7c2744f85e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ReadProcessMemory
GetProcAddress
LoadLibraryA
GetTempPathA
DeleteFileA
ReadFile
ResetEvent
WaitForSingleObject
GetLastError
CreateEventA
IsBadReadPtr
GetCommandLineA
CreateMutexA
GetCurrentProcessId
VirtualAlloc
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
ResumeThread
GetModuleFileNameA
VirtualProtectEx
WritePrivateProfileStringA
VirtualProtect
VirtualFree
GetPrivateProfileStringA
Thread32Next
GetThreadPriority
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetCurrentThreadId
RaiseException
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
SetThreadContext
SetUnhandledExceptionFilter
Process32Next
Process32First
GetModuleHandleA
GetCurrentProcess
TerminateProcess
CreateFileA
WriteFile
CloseHandle
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
TerminateThread
CreateThread
SetEvent
Sleep
user32
CallNextHookEx
GetWindowThreadProcessId
FindWindowA
GetForegroundWindow
UnhookWindowsHookEx
SetWindowsHookExA
GetWindowTextA
wininet
InternetCloseHandle
InternetOpenA
InternetReadFile
ws2_32
closesocket
shlwapi
PathFileExistsA
msvcrt
malloc
_adjust_fdiv
_strupr
_strnicmp
_stricmp
_strlwr
_wcslwr
_initterm
free
wcslen
strcmp
fopen
fread
sprintf
strcpy
strlen
strstr
memcpy
memset
strcat
??2@YAPAXI@Z
strrchr
wcsstr
fclose
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ