Static task
static1
Behavioral task
behavioral1
Sample
08df8ed8b9336bf23eb8aae2ad4a2c44_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
08df8ed8b9336bf23eb8aae2ad4a2c44_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
08df8ed8b9336bf23eb8aae2ad4a2c44_JaffaCakes118
-
Size
21KB
-
MD5
08df8ed8b9336bf23eb8aae2ad4a2c44
-
SHA1
262be4c4844e97dbeeca255cf25a620ac616391d
-
SHA256
4b83529b0052801bd50ca6da5936363223da7aefd9f088edf2c95544ad0abd9f
-
SHA512
48addf2ee0c2d6e967d989019a14b1ceafc7d1f8321b7d845701e834443666a44164662fc1b7c644f9884729a8ba5bab0a887f577c2b9955bbdcc98bc4ecb6ff
-
SSDEEP
384:b9+CF1bKXgovE9yR5AfyKBq2KJ4fokrDfMjKt2PCkaybJTVf+x+gP:wCFcXgoQyRtKBq2KdkrAPCkxbJR+V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 08df8ed8b9336bf23eb8aae2ad4a2c44_JaffaCakes118
Files
-
08df8ed8b9336bf23eb8aae2ad4a2c44_JaffaCakes118.dll windows:4 windows x86 arch:x86
6b821fb4615a4a49a94f4e6b13ee444f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ReadProcessMemory
GetCurrentProcess
GlobalLock
GlobalAlloc
GetModuleHandleA
CreateThread
GetCurrentThreadId
GlobalFree
GlobalUnlock
TerminateThread
RaiseException
InitializeCriticalSection
GetPrivateProfileStringA
WideCharToMultiByte
LeaveCriticalSection
GetProcAddress
LoadLibraryA
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleFileNameA
VirtualProtectEx
WriteProcessMemory
ResumeThread
ExitProcess
OpenProcess
TerminateProcess
GetTickCount
Sleep
IsBadReadPtr
GetCurrentProcessId
OpenMutexA
EnterCriticalSection
CreateMutexA
user32
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetForegroundWindow
GetWindowTextA
FindWindowA
GetWindowThreadProcessId
GetKeyState
imagehlp
ImageUnload
ImageLoad
shlwapi
PathFileExistsA
msvcrt
free
_initterm
malloc
_adjust_fdiv
_stricmp
_strlwr
strstr
wcslen
??2@YAPAXI@Z
strncpy
strrchr
strcat
sprintf
strcpy
strlen
memset
rand
srand
memcpy
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ