Static task
static1
Behavioral task
behavioral1
Sample
03A9E2B806824356E473EE5AFC6C8EEE.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
03A9E2B806824356E473EE5AFC6C8EEE.dll
Resource
win10v2004-20240412-en
General
-
Target
fe3fcd38bfa9cf95acc64f4d03b332cd_JaffaCakes118
-
Size
14KB
-
MD5
fe3fcd38bfa9cf95acc64f4d03b332cd
-
SHA1
1a349391cf39b9eef06db016fb331fe17783ea82
-
SHA256
28f57628bca612722b4ca439047b522b9a8af5a3efadfc456948810baa3fa5e6
-
SHA512
8d4843941c4654fcdc002c461eca28c7b5a046023f840e5766f84ea155041a75af36655c809f20c45abfec0e20b062d14d143db18e5fcd5b5201e774300c1263
-
SSDEEP
192:jNTM8QRVWqcM3f5F6r6qoWjJ4YoXSWWc5zTGkPkrrmEukAxyUGGYagWzH2ABfaNo:hhE5vxFCoCWW0vGkPkrKEttxWL2RzEew
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/03A9E2B806824356E473EE5AFC6C8EEE
Files
-
fe3fcd38bfa9cf95acc64f4d03b332cd_JaffaCakes118.zip
-
03A9E2B806824356E473EE5AFC6C8EEE.dll windows:4 windows x86 arch:x86
fd752f69492dc8b202c57a26035ed4b9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
strstr
memcpy
memcmp
_snprintf
RtlZeroMemory
RtlUnwind
strlen
ws2_32
gethostname
closesocket
kernel32
WriteFile
CloseHandle
CreateThread
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
IsBadReadPtr
LoadLibraryA
Sleep
TerminateThread
WaitForSingleObject
lstrcatA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
lstrcmpA
CreateFileA
CreateFileMappingA
CreateProcessA
DeleteFileA
GetExitCodeThread
GetFileSize
GetLastError
WideCharToMultiByte
GetSystemDirectoryA
GetTempFileNameA
GetTempPathA
MapViewOfFile
MoveFileExA
ReadFile
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtectEx
GetStartupInfoA
user32
UnhookWindowsHookEx
wsprintfA
CallNextHookEx
FindWindowA
GetWindowThreadProcessId
KillTimer
RegisterWindowMessageA
SendMessageA
SetTimer
SetWindowsHookExA
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ole32
StringFromGUID2
Sections
.text Size: 224KB - Virtual size: 223KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 8B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ