Static task
static1
Behavioral task
behavioral1
Sample
0850949288794dc856f1d6bfc841f29b_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0850949288794dc856f1d6bfc841f29b_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
0850949288794dc856f1d6bfc841f29b_JaffaCakes118
-
Size
154KB
-
MD5
0850949288794dc856f1d6bfc841f29b
-
SHA1
4d68af35c71700e91f58b6dc18a72484da122274
-
SHA256
fd59e0c2d81803d6d5d59bafe352765d9f91c605012533fa7494059601e3b895
-
SHA512
d02dc79fa7d069217611a8def5c0e8bb14b39c30fa967703c6dd58ced94b67c11d9665beb70186489e776121209993871e8efec8b536359adccdd1d7c021a691
-
SSDEEP
3072:gvmLKFwDaO6dC/++OxLOWe7Ih/i9XYnYZYs20Jaw1nQ5npOB:isaO+C/+++LvoFYYZCYaAa0B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0850949288794dc856f1d6bfc841f29b_JaffaCakes118
Files
-
0850949288794dc856f1d6bfc841f29b_JaffaCakes118.dll windows:4 windows x86 arch:x86
66545383c66f7b5ee5c6948cd826c2f5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
GetProcAddress
GetUserDefaultLCID
GetSystemTimeAsFileTime
IsDBCSLeadByte
VirtualAlloc
VirtualProtect
VirtualQuery
DosDateTimeToFileTime
GetTickCount
Sleep
QueryPerformanceFrequency
QueryPerformanceCounter
GetComputerNameA
GetCurrentProcess
GetProcessHeap
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
GetLocalTime
user32
GetClientRect
GetWindowTextLengthA
GetWindowTextA
IsCharAlphaNumericA
GetWindowDC
IsClipboardFormatAvailable
GetDlgItem
GetAncestor
GetTitleBarInfo
GetWindow
IsZoomed
GetWindowPlacement
GetDesktopWindow
BlockInput
SetLastErrorEx
GetCursor
advapi32
RevertToSelf
GetUserNameA
AreAnyAccessesGranted
InitializeSecurityDescriptor
IsValidSecurityDescriptor
msvcrt
malloc
_initterm
free
_swab
_memccpy
_ltoa
srand
_adjust_fdiv
_CIacos
_set_error_mode
time
_hypot
_pctype
_isctype
__mb_cur_max
floor
_errno
__doserrno
div
gdi32
GetBitmapDimensionEx
GetBkColor
GdiGetBatchLimit
ole32
CoGetCurrentProcess
CoRevertToSelf
shell32
DuplicateIcon
ord524
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 61KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ