Static task
static1
Behavioral task
behavioral1
Sample
1c2c7d70a88c3b120370c286947787d3_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1c2c7d70a88c3b120370c286947787d3_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
1c2c7d70a88c3b120370c286947787d3_JaffaCakes118
-
Size
165KB
-
MD5
1c2c7d70a88c3b120370c286947787d3
-
SHA1
1907da4c141d8fe547b3e5c37031628e721fb3a6
-
SHA256
910cda96746aad93c7231be794e4b4a611f8f8b249ca3eef3056eeba1b12c4d3
-
SHA512
89501bef3039092e45e1428da23da850d64aedeadba7b138e35eca3d1d50deaec2e9baddc7eef559af509ad16e406e9a92d987965b5ac9181a1b29924de17db5
-
SSDEEP
3072:lHQGUhXaeDlbLfrct9xP6CzumE97f/fzoviRHcHoqB8C7IbowFfs5neY:eae5bH49p3uX97HIoHcII8CUEwFfOeY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1c2c7d70a88c3b120370c286947787d3_JaffaCakes118
Files
-
1c2c7d70a88c3b120370c286947787d3_JaffaCakes118.dll windows:4 windows x86 arch:x86
c7e34d04667a2e1d570d2b11fc9afd72
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameA
GetProcAddress
GetUserDefaultLCID
VirtualAlloc
VirtualProtect
DosDateTimeToFileTime
GetCurrentProcess
GetCurrentThreadId
LoadLibraryA
GetACP
Sleep
QueryPerformanceCounter
IsDebuggerPresent
IsBadStringPtrA
user32
GetMenuContextHelpId
GetWindowTextA
IsCharAlphaNumericA
GetWindowRgn
GetWindowDC
GetDC
GetForegroundWindow
GetIconInfo
GetDlgItem
GetAncestor
GetTitleBarInfo
GetWindow
GetLastActivePopup
GetWindowThreadProcessId
IsIconic
IsWindowVisible
GetGUIThreadInfo
InSendMessage
SetLastErrorEx
IsWindowUnicode
advapi32
AreAnyAccessesGranted
GetUserNameA
msvcrt
_adjust_fdiv
malloc
_initterm
free
_memicmp
_set_error_mode
_CItanh
_CIfmod
_CIsinh
ceil
_CIpow
div
_itoa
time
_pctype
_isctype
__mb_cur_max
_ltoa
gdi32
GdiFlush
GdiGetBatchLimit
GetROP2
GetBitmapDimensionEx
ole32
CoDosDateTimeToFileTime
shell32
DuplicateIcon
ord524
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 69KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ