Static task
static1
Behavioral task
behavioral1
Sample
197f42a21579c5cfe7997c5130bb5c98_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
197f42a21579c5cfe7997c5130bb5c98_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
197f42a21579c5cfe7997c5130bb5c98_JaffaCakes118
-
Size
24KB
-
MD5
197f42a21579c5cfe7997c5130bb5c98
-
SHA1
7c2d739c67b14699160ff93b19f5099fa4a36969
-
SHA256
b066c135a254cc8503165fee3dd53e5c4c8ca2d6c01fefaba61494f55d9b66fb
-
SHA512
4a891e5962d8e05f2f0b007124a7872a7201eb46415cd16f3b030e2c2572a4422c6a09de66c25ee813f67afb8cab0f887b4627fd65100f539cb14899e5d93689
-
SSDEEP
384:D5f6Ec1u75fdH+oQ29Qq0pct5J/fnKGysa:DYEHpdH+oZQvat55fnKGl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 197f42a21579c5cfe7997c5130bb5c98_JaffaCakes118
Files
-
197f42a21579c5cfe7997c5130bb5c98_JaffaCakes118.dll windows:4 windows x86 arch:x86
47e3f8daa60acbc4b0f1a746d6f15a3c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
ntohs
ntohl
closesocket
msvcrt
_initterm
malloc
free
_strupr
atoi
memcpy
strcmp
fwrite
time
strrchr
fopen
fseek
ftell
??2@YAPAXI@Z
memset
fread
fclose
strstr
strchr
strncpy
??3@YAXPAX@Z
_strlwr
_itoa
_adjust_fdiv
kernel32
CreateEventA
lstrcmpA
WaitForSingleObject
SetEvent
CreateThread
GetModuleHandleA
LoadLibraryA
CopyFileA
GetProcAddress
GetTempPathA
WideCharToMultiByte
lstrcpyA
lstrlenA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
GetModuleFileNameA
Sleep
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 894B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ