Static task
static1
Behavioral task
behavioral1
Sample
256ec4678e89f2cec42450240726005b_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
256ec4678e89f2cec42450240726005b_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
256ec4678e89f2cec42450240726005b_JaffaCakes118
-
Size
20KB
-
MD5
256ec4678e89f2cec42450240726005b
-
SHA1
e1ddd869519ed787ccfe35d30ad483546865e57a
-
SHA256
4eb1962559c329f4c259012be9db09422c1f67227f56ae075561c662a091032d
-
SHA512
dbbc408dab66e4506bdbbc796e3300749e17c4766bceed878d971b842c38f73dfd34b4383444d448b6adf882a887863b5317ce68b5e6f84c090ef4bc4e4c3d86
-
SSDEEP
384:1zz36y0C5GQStS7HjJQa30+Mxw11vAgrFX:p6y0tQqS7qaiu11XrJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 256ec4678e89f2cec42450240726005b_JaffaCakes118
Files
-
256ec4678e89f2cec42450240726005b_JaffaCakes118.dll windows:4 windows x86 arch:x86
99b33b930a18c1a96eb450954f0e4cb5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
DeleteFileA
CreateFileA
WriteFile
OpenEventA
Sleep
GetFileSize
ReadFile
GetModuleFileNameA
TerminateProcess
VirtualProtectEx
WideCharToMultiByte
ReadProcessMemory
GetProcAddress
GlobalLock
GlobalAlloc
GetCurrentProcess
GetCurrentThread
GetCurrentProcessId
CreateEventA
SetThreadPriority
CreateThread
GetPrivateProfileStringA
OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
CreateRemoteThread
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
VirtualFree
GlobalFree
VirtualAlloc
user32
DeleteMenu
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DrawIcon
GetDC
GetCursor
GetDCEx
GetDesktopWindow
wsprintfA
GetInputState
PostThreadMessageA
GetMessageA
gdi32
DeleteObject
GetBkMode
advapi32
RegCreateKeyExA
OpenProcessToken
LookupPrivilegeValueA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
AdjustTokenPrivileges
wininet
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ