Static task
static1
Behavioral task
behavioral1
Sample
01e3b55169fabaa69db88136b949bc5c_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
01e3b55169fabaa69db88136b949bc5c_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
01e3b55169fabaa69db88136b949bc5c_JaffaCakes118
-
Size
20KB
-
MD5
01e3b55169fabaa69db88136b949bc5c
-
SHA1
948df64afebf952f3051174f7907a56b0f61d046
-
SHA256
5bdffcf3c2efac4e5003ea1a587f87331c6984c64a3236ab7701c0e14735f984
-
SHA512
25c12c369c310d539505ea84444381cfd4d7e4bfd2885c8bea7d01aa696f93cc26b02a905cfeccea7079f1ef1020df703be3e7009a44ba4409581a5d69c57a72
-
SSDEEP
384:M+Jd5AnXHooSkDlxQ7H0TmuvvpkuB+n7sO:yXHofMbTDnisI7s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 01e3b55169fabaa69db88136b949bc5c_JaffaCakes118
Files
-
01e3b55169fabaa69db88136b949bc5c_JaffaCakes118.dll windows:4 windows x86 arch:x86
d989fa40b61bdb4ce9e8800ff7dce7fb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
WriteProcessMemory
VirtualAllocEx
FindClose
FindNextFileA
lstrcpynA
lstrcpyA
lstrcmpA
FindFirstFileA
VirtualProtectEx
Module32Next
Module32First
ReadFile
GetModuleFileNameA
VirtualFreeEx
CreateRemoteThread
Sleep
CreateThread
WinExec
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
OpenProcess
CreateMutexA
GetLastError
ReleaseMutex
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
Process32Next
GetSystemDirectoryA
lstrlenA
GetModuleHandleA
GetProcAddress
SizeofResource
LoadResource
WaitForSingleObject
WriteFile
CloseHandle
GetTempPathA
GetTickCount
user32
wsprintfA
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
shlwapi
StrStrIA
wininet
InternetCloseHandle
msvcrt
_itoa
strcmp
memcpy
??2@YAPAXI@Z
strstr
strncat
strcat
strlen
memset
strcpy
??3@YAXPAX@Z
_purecall
Sections
.bss Size: - Virtual size: 13KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: 1024B - Virtual size: 532B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ