Static task
static1
Behavioral task
behavioral1
Sample
017c0fd669063d8c5e4f2c9abc4df780_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
017c0fd669063d8c5e4f2c9abc4df780_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
017c0fd669063d8c5e4f2c9abc4df780_JaffaCakes118
-
Size
27KB
-
MD5
017c0fd669063d8c5e4f2c9abc4df780
-
SHA1
d5837a6d6fa05810fe268b60d4a95f60075cd5b8
-
SHA256
72b41ac7df1214c85521bc1857e79dfdfae1553087285d6ed9bddbff1c9ff453
-
SHA512
3d7e25a35dcb8c89229420ece909acf1e224d4b68e2f5ad28aac74619aa570faf39339621c03b68e843152212bb55dd42068d0095fc96ddc124650eebd217256
-
SSDEEP
768:OLCMFqQVU6Fcl1UFA2ZmDX+M6qGAd/dv1Y:OOM4ky2uX+G/N1Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 017c0fd669063d8c5e4f2c9abc4df780_JaffaCakes118
Files
-
017c0fd669063d8c5e4f2c9abc4df780_JaffaCakes118.dll windows:4 windows x86 arch:x86
d4ec8e160350731532d8914cb647d400
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
CreateEventA
SetEvent
WriteFile
ExitProcess
GetModuleHandleA
IsBadReadPtr
GetCommandLineA
CreateMutexA
GetCurrentProcessId
VirtualAlloc
LoadLibraryA
VirtualFree
GetPrivateProfileStringA
WriteProcessMemory
WritePrivateProfileStringA
TerminateProcess
ResumeThread
VirtualProtectEx
OpenProcess
GetModuleFileNameA
ReadProcessMemory
GetCurrentProcess
GetCurrentThreadId
RaiseException
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
CreateFileA
ReadFile
CloseHandle
GetTempPathA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
TerminateThread
CreateThread
GetProcAddress
Sleep
user32
GetForegroundWindow
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
GetWindowThreadProcessId
GetWindowTextA
FindWindowA
wininet
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile
imagehlp
ImageLoad
ImageUnload
msvcrt
free
_initterm
malloc
_adjust_fdiv
_strnicmp
_stricmp
_strlwr
wcslen
strcmp
fopen
fread
fclose
strchr
sprintf
strcpy
strlen
strstr
strcat
memcpy
memset
??2@YAPAXI@Z
strrchr
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ