Static task
static1
Behavioral task
behavioral1
Sample
078711f9ad13f66c65f486db62c860e6_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
078711f9ad13f66c65f486db62c860e6_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
078711f9ad13f66c65f486db62c860e6_JaffaCakes118
-
Size
33KB
-
MD5
078711f9ad13f66c65f486db62c860e6
-
SHA1
845600b78e0a30eb059e59487c433806b4fcea6f
-
SHA256
62a9dbef738369b67dfea1552e22b75ad10d13e716a7c9652ce65515108ee7ab
-
SHA512
b3f809284ac20a809b3af1c45300fc82eae893b5a7ba743d0c9f33b2dd25fc15743e3c37d23179168334b5de3fd0bfcd28a656d13921f5cb7732b8340da43eec
-
SSDEEP
384:4c7d1h52wtQeLKrnjLVZe9vpFuqRvcCucmdqUH9kn28rypcnlIJ6Jb6T6pdI82Uc:lJ52wtQeLItZeNLRQqUD/cnlIJYPghR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 078711f9ad13f66c65f486db62c860e6_JaffaCakes118
Files
-
078711f9ad13f66c65f486db62c860e6_JaffaCakes118.dll windows:4 windows x86 arch:x86
fa130c32018e5c9a6ca8e9f42e0c3f91
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcessId
GetPrivateProfileStringA
DeleteFileA
ReadFile
GetFileSize
CreateFileA
GetTempPathA
GetPrivateProfileIntA
GetProcAddress
CreateThread
Sleep
WriteFile
WritePrivateProfileStringA
LoadLibraryA
WideCharToMultiByte
ReadProcessMemory
SetThreadPriority
GetProcessHeap
HeapAlloc
GetModuleFileNameA
GetLastError
GetModuleHandleA
CloseHandle
VirtualProtect
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
msvcrt
sprintf
wcscmp
mbstowcs
wcscpy
wcsncat
wcslen
wcsstr
strrchr
_except_handler3
strchr
_vsnprintf
isspace
isalnum
wcscat
fclose
fopen
atoi
exit
__dllonexit
_onexit
_initterm
_adjust_fdiv
_strcmpi
_itoa
strncpy
strlen
strcat
malloc
strcpy
_stricmp
_strlwr
strstr
free
memcpy
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
gdiplus
GdipSaveImageToFile
GdipDisposeImage
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdiplusStartup
gdi32
DeleteDC
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
CreateDCA
DeleteObject
wsock32
closesocket
shutdown
user32
GetClassNameW
GetWindow
wsprintfA
GetForegroundWindow
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ