Static task
static1
Behavioral task
behavioral1
Sample
10511fbf3af87e93bfb16f89577d51e1_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
10511fbf3af87e93bfb16f89577d51e1_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
10511fbf3af87e93bfb16f89577d51e1_JaffaCakes118
-
Size
38KB
-
MD5
10511fbf3af87e93bfb16f89577d51e1
-
SHA1
698c34299671f11538a7b742791485d59c851da2
-
SHA256
1c8074ce5898ef3478cfb08b881322af3ab615c0dd1ddd960d2f0187c93d3eca
-
SHA512
7b1a480a48e233c9f3e163b4877a38979532612a8b151e3cfc6bd6da0584f86be1873a02bcb4a9fa9aff7e4b9012858fd8ab0d576664888bd5076d2e80ec65d4
-
SSDEEP
384:b1aW5u7SasEk/xLV7f09ERGvjO9558shJGozX+VlQYIYb0B9tq6NMCN3HCC:bR0QffRUO7GsmM+3xb0X3HCC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 10511fbf3af87e93bfb16f89577d51e1_JaffaCakes118
Files
-
10511fbf3af87e93bfb16f89577d51e1_JaffaCakes118.dll windows:4 windows x86 arch:x86
2587344aa5dcd781462dd03ff2333be4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetFileSize
CreateFileA
SetFilePointer
OutputDebugStringA
HeapAlloc
GetProcessHeap
GetModuleHandleA
lstrcpynA
GetModuleFileNameA
FreeLibrary
ReadFile
WideCharToMultiByte
VirtualQueryEx
ReadProcessMemory
GetFileAttributesW
CloseHandle
GetTempPathA
DeleteFileA
Sleep
GetCurrentProcessId
OpenProcess
TerminateProcess
GetCurrentProcess
IsBadReadPtr
lstrlenA
GetProcAddress
LoadLibraryA
user32
GetDC
GetWindowRect
wvsprintfA
GetWindowTextA
FindWindowA
wsprintfA
GetWindow
GetClassNameW
advapi32
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
msvcrt
_strupr
free
strcpy
memset
malloc
strcat
sprintf
strlen
??3@YAXPAX@Z
wcscmp
??2@YAPAXI@Z
fclose
ftell
fseek
fopen
mbstowcs
_except_handler3
memmove
memcpy
strchr
strstr
isprint
rand
srand
time
wcslen
wcsncat
wcscpy
wcsstr
strncpy
_stricmp
strrchr
exit
printf
__CxxFrameHandler
strcmp
_vsnprintf
realloc
isdigit
isalpha
atoi
_strcmpi
_strdup
wininet
InternetCloseHandle
wsock32
WSAStartup
socket
htons
recv
closesocket
send
gethostbyname
connect
gdi32
DeleteDC
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
CreateDCA
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ