Init
Static task
static1
Behavioral task
behavioral1
Sample
03ffb09a8875e19d97bede9738bdd658_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
03ffb09a8875e19d97bede9738bdd658_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
03ffb09a8875e19d97bede9738bdd658_JaffaCakes118
-
Size
26KB
-
MD5
03ffb09a8875e19d97bede9738bdd658
-
SHA1
63a3d19ee07d88bc7b38f9d664617db65d2512a8
-
SHA256
11af249bcf21b8883ec14f5a60cb13d6512e807cab0c75cc3aa87b4488fb04a9
-
SHA512
2bac9efbd70113ce995e20a087735cf603368f3bfa8d097cb741494432bf3ade2ab320640c55b1a9949fdad7026cdafe3bee6cf8102055147b3c30cfb5a2a8bd
-
SSDEEP
768:bK+aeKI5yIzqv6N36O9DLuDlfeATS+rYj40KXhoO2:YeKILJaDlfeAG+MgXz2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03ffb09a8875e19d97bede9738bdd658_JaffaCakes118
Files
-
03ffb09a8875e19d97bede9738bdd658_JaffaCakes118.dll windows:4 windows x86 arch:x86
124886f0829ab8a31255a062699ac8b7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
IsBadReadPtr
CreateThread
WriteProcessMemory
TerminateThread
GetPrivateProfileStringA
GetPrivateProfileIntA
InitializeCriticalSection
VirtualProtectEx
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetProcAddress
LoadLibraryA
GetModuleHandleA
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
ReadProcessMemory
CloseHandle
GlobalAlloc
Process32First
CreateToolhelp32Snapshot
GetSystemDirectoryA
VirtualAlloc
WritePrivateProfileStringA
GetLastError
CreateMutexA
ExitProcess
WaitForSingleObject
ResetEvent
SetEvent
CreateEventA
DeleteFileA
GetModuleFileNameA
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
ResumeThread
OpenProcess
CreateProcessA
GetCurrentThread
GlobalLock
GlobalUnlock
Process32Next
GlobalFree
user32
GetWindowTextA
GetWindowThreadProcessId
GetDesktopWindow
SendMessageA
GetWindow
GetForegroundWindow
FindWindowA
GetMessageA
CallNextHookEx
SetWindowsHookExA
GetClassNameA
TranslateMessage
DispatchMessageA
FindWindowExA
UnhookWindowsHookEx
advapi32
RegSetValueExA
RegCreateKeyExA
RegCloseKey
shlwapi
PathFileExistsA
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
imagehlp
ImageLoad
ImageUnload
msvcrt
_strlwr
_adjust_fdiv
malloc
_initterm
free
??3@YAXPAX@Z
strncpy
sscanf
strrchr
fread
strcat
??2@YAPAXI@Z
_stricmp
memset
strstr
strlen
wcslen
strcmp
memcpy
sprintf
strcpy
fopen
fclose
Exports
Exports
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sdt Size: 512B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ