Static task
static1
Behavioral task
behavioral1
Sample
156bef191386c29f6312d06950555d62_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
156bef191386c29f6312d06950555d62_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
156bef191386c29f6312d06950555d62_JaffaCakes118
-
Size
164KB
-
MD5
156bef191386c29f6312d06950555d62
-
SHA1
6ec6a5368eff37f40877add5f771ea1a575148f9
-
SHA256
8562faf499a8a9fa7d64f6dca6e43cec27742db44907a24c193156b7e825b03d
-
SHA512
c8d63b139c5a2e02a06c8f7c729527a505c4b1bbb5d6d57c6048de8d1f3302d163e2f5c1a9f0c74fbc4629f9beb3c916a82f603ff4df5fd37c42ea704eac56e4
-
SSDEEP
3072:cGI5Otw0+G6D16xp4JItmSQxG+3vxFYbFFmUJbQIr7xN/xayaoFBskUYn3J3ObTS:aAy0v6Dcp4JcUkAFQIoDxioFmkP5enNc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 156bef191386c29f6312d06950555d62_JaffaCakes118
Files
-
156bef191386c29f6312d06950555d62_JaffaCakes118.dll windows:4 windows x86 arch:x86
16b21a777316b3978203738709873676
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
GetModuleFileNameA
GetProcAddress
GetVersion
IsDBCSLeadByte
MulDiv
GetSystemTimeAsFileTime
VirtualAlloc
VirtualProtect
VirtualQuery
DosDateTimeToFileTime
Sleep
SetLastError
GetLastError
GetComputerNameA
GetCurrentThreadId
GetProcessHeap
IsBadStringPtrA
IsBadWritePtr
GetStartupInfoA
user32
IsWindowUnicode
GetWindowContextHelpId
GetWindowRect
GetWindowTextA
IsCharUpperA
IsCharAlphaNumericA
IsClipboardFormatAvailable
GetDC
WindowFromDC
GetForegroundWindow
GetIconInfo
CopyIcon
GetDlgItem
GetAncestor
GetTitleBarInfo
GetWindow
GetLastActivePopup
GetWindowThreadProcessId
GetGUIThreadInfo
GetParent
BlockInput
IsChild
GetDesktopWindow
GetWindowTextLengthA
advapi32
IsValidAcl
IsValidSecurityDescriptor
InitializeSecurityDescriptor
RevertToSelf
msvcrt
_adjust_fdiv
malloc
_initterm
free
memmove
rand
_CItanh
_CIsinh
_CIacos
_CIfmod
_isctype
_CIpow
_itoa
__doserrno
_errno
_pctype
time
__mb_cur_max
gdi32
GetBkMode
GdiFlush
GetBkColor
ole32
CoGetCurrentProcess
CoFileTimeNow
CoDosDateTimeToFileTime
CoRevertToSelf
shell32
ord66
ord680
DuplicateIcon
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ