___CPPdebugHook
Static task
static1
Behavioral task
behavioral1
Sample
161be61b2ec8d80dc4466900f585edf9_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
161be61b2ec8d80dc4466900f585edf9_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
161be61b2ec8d80dc4466900f585edf9_JaffaCakes118
-
Size
66KB
-
MD5
161be61b2ec8d80dc4466900f585edf9
-
SHA1
7216a433e84f1f39699b63f9286c2ce25d36efcc
-
SHA256
e5d024366c5b04a47d2f6801d47cab67398290bb27cbf530aaafde71cd6f9650
-
SHA512
1dba65185cea576186294fb0b8fc59b5c8920d8eb50a4f231b740f7b5e2a1de93354e70404816590d8dd41c48542efc548cfa14d37e93c1ac152fb1361894169
-
SSDEEP
1536:0yfBOIoqQhhOr9/M7cW69Ue7kLt5bnZGcG+AK:/OIoqQhWqclkLnb9AK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 161be61b2ec8d80dc4466900f585edf9_JaffaCakes118
Files
-
161be61b2ec8d80dc4466900f585edf9_JaffaCakes118.dll windows:4 windows x86 arch:x86
b4651c6e144daa2b3139b66a5275cad5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CreateFileA
CreateThread
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsA
GetACP
GetCPInfo
GetCurrentThreadId
GetEnvironmentStrings
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetTimeZoneInformation
GetVersion
GetVersionExA
GlobalAlloc
GlobalFree
GlobalMemoryStatus
HeapAlloc
HeapFree
InitializeCriticalSection
LCMapStringA
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
OpenFile
RaiseException
ReadFile
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WideCharToMultiByte
WriteFile
GetVolumeInformationA
wsock32
WSACleanup
WSAStartup
accept
closesocket
connect
gethostbyname
htons
listen
recv
send
shutdown
socket
bind
user32
EnumThreadWindows
MessageBoxA
wsprintfA
Exports
Exports
Sections
.text Size: 45KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ