Static task
static1
Behavioral task
behavioral1
Sample
0d67fd8828ccd4e216c70b796e152d16_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0d67fd8828ccd4e216c70b796e152d16_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0d67fd8828ccd4e216c70b796e152d16_JaffaCakes118
-
Size
35KB
-
MD5
0d67fd8828ccd4e216c70b796e152d16
-
SHA1
52e7a456e65591462b9177ee39cb499e24272dc0
-
SHA256
c3f0ba7d862c14d903658473f255137c0b7e1dc56a4185aeb470a02bd902a257
-
SHA512
efb9b7494371459cf29822e58459ed85890bcc5aab9c52cc48bc9f91b97d8318edeb29625b77b9b69975cc131d98a78beaa715cc8029e4a6685223f9c537e032
-
SSDEEP
384:pdJPn6TYyz3HNAgBiBrpct5zkIND0xpbPSTp1g8O:LdnjybHNvBiBrat5FNADPSTa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d67fd8828ccd4e216c70b796e152d16_JaffaCakes118
Files
-
0d67fd8828ccd4e216c70b796e152d16_JaffaCakes118.dll windows:4 windows x86 arch:x86
97203822b5490304f4173c5641f883b3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
GetWindowTextA
FindWindowExA
FindWindowA
EnumChildWindows
EnableWindow
ws2_32
ntohs
closesocket
msvcrt
free
_initterm
malloc
_adjust_fdiv
_itoa
strcmp
atoi
strcpy
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
rand
fopen
fwrite
fclose
fread
time
memset
_strlwr
srand
kernel32
IsBadReadPtr
GetModuleFileNameA
GetModuleHandleA
GetTickCount
lstrlenA
CopyFileA
CreateThread
GetTempPathA
LoadLibraryA
GetProcAddress
VirtualAllocEx
GlobalAlloc
GlobalLock
CreateRemoteThread
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
Sleep
lstrcmpA
lstrcpyA
Sections
.text Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 752B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ