Static task
static1
Behavioral task
behavioral1
Sample
2bda3969561449ec54b33e3033b40080_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2bda3969561449ec54b33e3033b40080_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2bda3969561449ec54b33e3033b40080_JaffaCakes118
-
Size
25KB
-
MD5
2bda3969561449ec54b33e3033b40080
-
SHA1
efe987689ada2296a8c0bd5508e13db1bb5d0a92
-
SHA256
4880aba2760b28752f9280e048a6e3dabf830200dc100e7c7f697d6025878ea4
-
SHA512
9c27e6a922296d57a03e63645255f07d17a8c379ec1f6d98bd48695b3d42f36c8d2ffbc3efae32e71b1c00f75c556b9495baaef617d9b3ebefce7def1b933467
-
SSDEEP
384:A8LmCB4V8FNqZMyihVQpR/X+/Jyfr1+P7YDo9HU:A8iCTQivVeCJar1UYDo9HU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2bda3969561449ec54b33e3033b40080_JaffaCakes118
Files
-
2bda3969561449ec54b33e3033b40080_JaffaCakes118.dll windows:4 windows x86 arch:x86
578cd18c02f386ee65d43af69abeb03b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateFileA
WriteFile
OpenEventA
Sleep
GetFileSize
ReadFile
GetModuleFileNameA
ExitProcess
VirtualProtectEx
ReadProcessMemory
GlobalFree
GlobalLock
DeleteFileA
GetCurrentProcess
OutputDebugStringA
CopyFileA
CreateEventA
SetThreadPriority
CreateThread
WideCharToMultiByte
MultiByteToWideChar
IsBadReadPtr
GetStringTypeW
GetStringTypeA
RtlUnwind
GetModuleHandleA
GetProcAddress
OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
CreateRemoteThread
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
VirtualFree
GlobalAlloc
VirtualAlloc
user32
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
CheckRadioButton
CloseDesktop
CloseWindow
CloseWindowStation
CheckDlgButton
CheckMenuItem
CheckMenuRadioItem
DeleteMenu
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
wsprintfA
GetMessageA
PostThreadMessageA
GetInputState
gdi32
Chord
CloseEnhMetaFile
CloseMetaFile
DeleteObject
CancelDC
advapi32
RegOpenKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
wininet
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
InternetOpenA
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ