Static task
static1
Behavioral task
behavioral1
Sample
14b3bad26cd279114c4e552d9df1c30f_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
14b3bad26cd279114c4e552d9df1c30f_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
14b3bad26cd279114c4e552d9df1c30f_JaffaCakes118
-
Size
24KB
-
MD5
14b3bad26cd279114c4e552d9df1c30f
-
SHA1
a5df1080659055a675ed49247f67dc1af5da81ed
-
SHA256
4f7fc63118874331cb296ab8c99de539c882b40e9b2e2257dc3306843b643d86
-
SHA512
2c5bf0370d035e00f1b765d970f2413d53d20f9c291de5d2610f3fdc31298b34673b0928707ea3732317fbb8af7083f0023503b65176c2c0e7e49ffcce6041d9
-
SSDEEP
384:7e7VwOh+P27xqFLEYIOGWg+MZsbnm8RCC3f9Nbt5aQR8/2MbBrgBJgmWJGbUY+h:7essO9QZsi8nlNbt5aQYrgBRghhm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14b3bad26cd279114c4e552d9df1c30f_JaffaCakes118
Files
-
14b3bad26cd279114c4e552d9df1c30f_JaffaCakes118.dll windows:4 windows x86 arch:x86
a1fc07a14cb5aab3814826d851b98a41
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
InitializeCriticalSection
GetPrivateProfileStringA
LeaveCriticalSection
EnterCriticalSection
CreateMutexA
OpenMutexA
GetCurrentProcessId
GetProcAddress
LoadLibraryA
GetModuleHandleA
ResumeThread
SetThreadContext
SuspendThread
OpenThread
IsBadReadPtr
GetCurrentThread
GetModuleFileNameA
WriteProcessMemory
GlobalUnlock
GlobalFree
TerminateThread
MultiByteToWideChar
WideCharToMultiByte
Sleep
GlobalAlloc
GlobalLock
ReadProcessMemory
CreateThread
GetCurrentProcess
GetCurrentThreadId
SetUnhandledExceptionFilter
VirtualProtectEx
user32
GetWindowThreadProcessId
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetForegroundWindow
GetWindowTextA
FindWindowA
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
msvcrt
free
_initterm
malloc
_adjust_fdiv
_stricmp
_strlwr
strrchr
wcslen
strcat
sscanf
??3@YAXPAX@Z
strcpy
??2@YAPAXI@Z
sprintf
strlen
memcpy
strncpy
strchr
strstr
fclose
fread
fopen
memset
strcmp
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ