Static task
static1
Behavioral task
behavioral1
Sample
25a438e8971ef01f6e6b19e4ee44ff2d_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
25a438e8971ef01f6e6b19e4ee44ff2d_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
25a438e8971ef01f6e6b19e4ee44ff2d_JaffaCakes118
-
Size
60KB
-
MD5
25a438e8971ef01f6e6b19e4ee44ff2d
-
SHA1
db950703855cee60f3b7b33c752b901e799e9d8e
-
SHA256
f5a2f78a1628d13fcc64ae921b5740bdd0c02ffcedc541d97844fe9cf54e271a
-
SHA512
c58b5661666ff5c147bced84ba45fbde410aca8846079e895a91eed7ca433448477dd6758e68f0dfab42360dff57af4210f523e99f8d70a854cc7e8de0341d5b
-
SSDEEP
768:2aNhAP6Qs1nmr4S/JbQp6QbcC+sUkZ9iTL:2LykrV/xQp6QAKUg9+L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25a438e8971ef01f6e6b19e4ee44ff2d_JaffaCakes118
Files
-
25a438e8971ef01f6e6b19e4ee44ff2d_JaffaCakes118.dll windows:4 windows x86 arch:x86
58fde0ef3721a7aff0acfbc0107ae5dd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
GetProcAddress
Sleep
LocalAlloc
MultiByteToWideChar
VirtualProtect
CreateThread
GetCurrentProcessId
GetPrivateProfileStringA
GetSystemDirectoryA
GetTickCount
WritePrivateProfileStringA
VirtualAlloc
VirtualFree
VirtualQuery
HeapCreate
GetSystemInfo
lstrcpyA
GetModuleFileNameA
InterlockedIncrement
LoadLibraryA
GetCommandLineA
Process32Next
TerminateProcess
OpenProcess
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
ReadProcessMemory
VirtualProtectEx
WriteProcessMemory
GetCurrentProcess
Module32Next
Module32First
lstrlenW
WideCharToMultiByte
IsBadReadPtr
OpenFileMappingA
CloseHandle
CreateFileMappingA
MapViewOfFile
lstrlenA
UnmapViewOfFile
user32
wsprintfA
advapi32
CryptCreateHash
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CryptHashData
shlwapi
StrStrIA
StrStrW
StrStrA
msvcrt
??2@YAPAXI@Z
_stricmp
_memicmp
_adjust_fdiv
_initterm
isprint
strstr
sscanf
__CxxFrameHandler
sprintf
??3@YAXPAX@Z
_itoa
isspace
isalnum
free
malloc
atol
strrchr
Sections
.text Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ