Static task
static1
Behavioral task
behavioral1
Sample
0efe1529ccb9a64ba70bcd61ed0fdb12_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0efe1529ccb9a64ba70bcd61ed0fdb12_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
0efe1529ccb9a64ba70bcd61ed0fdb12_JaffaCakes118
-
Size
533KB
-
MD5
0efe1529ccb9a64ba70bcd61ed0fdb12
-
SHA1
2d1e875774fdfc886d2fb6528ac2383a00a3e583
-
SHA256
6b3708b2dcab6a19e32fe61b9e308eef66d12f181c96175e9f1a6fa4190bb4c2
-
SHA512
75dd597b36babf44c08b69de6e50f97bc21046b1df417b611364980165c50a9a860b9e5ddc485e0ed9f677d72f7f10544a297ad0f139a51f3e3a48328cbe7cd3
-
SSDEEP
12288:L8lgwA7d1ZQsmiDSUkoTjPJApKTbbnMZPaZDNRCUC7mY:AlVc1ZQBQkoTjPCpKTbzMxaZE7mY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0efe1529ccb9a64ba70bcd61ed0fdb12_JaffaCakes118
Files
-
0efe1529ccb9a64ba70bcd61ed0fdb12_JaffaCakes118.dll windows:4 windows x86 arch:x86
1bccf08608ed22b7dac86ef38e4bd331
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateFileA
GetPrivateProfileStringA
GetCurrentProcessId
GetTickCount
IsBadReadPtr
ExitProcess
Thread32Next
TerminateThread
Thread32First
CreateToolhelp32Snapshot
GetProcAddress
GetModuleHandleA
SetFilePointer
HeapAlloc
GetProcessHeap
VirtualProtect
GetFileSize
LoadLibraryA
GetCommandLineA
ReadFile
SetEvent
CloseHandle
GetModuleFileNameA
Sleep
GetCurrentProcess
TerminateProcess
OpenEventA
CreateEventA
CreateThread
user32
BroadcastSystemMessageA
SetWindowsHookExA
CallNextHookEx
GetWindowThreadProcessId
FindWindowA
IsWindowVisible
GetWindowTextA
GetWindowLongA
FindWindowExA
wsprintfA
wvsprintfA
advapi32
RegQueryValueExA
RegSetValueA
RegCreateKeyA
RegOpenKeyA
RegCloseKey
RegSetValueExA
msvcrt
strrchr
_strcmpi
_adjust_fdiv
_initterm
_strlwr
realloc
strcpy
strcat
strlen
free
strncpy
strchr
strstr
memset
malloc
sprintf
memcpy
_except_handler3
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ