Static task
static1
Behavioral task
behavioral1
Sample
2c59d0dd4f6db3535dfeb5fa4e0f8bbb_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2c59d0dd4f6db3535dfeb5fa4e0f8bbb_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2c59d0dd4f6db3535dfeb5fa4e0f8bbb_JaffaCakes118
-
Size
28KB
-
MD5
2c59d0dd4f6db3535dfeb5fa4e0f8bbb
-
SHA1
737b0e51ade8277f170313eabd284ee7289d3e14
-
SHA256
a131f3cee4ee11205346f9cc217ee29571d853968df45bef20b105e919f39596
-
SHA512
16f61827f9cf400dbd1697ea835072b3d893bf9f9fb53592fe256c95ab03eadf3ae71fd467b8e6e68914e5fd6ca151a767b35bc0913c908223694ed4024998b3
-
SSDEEP
768:E+ARDeSO4n/UlqGOQdujSqkODy69ybhk+4j6:5ARDfOkU7OQuy6F+r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c59d0dd4f6db3535dfeb5fa4e0f8bbb_JaffaCakes118
Files
-
2c59d0dd4f6db3535dfeb5fa4e0f8bbb_JaffaCakes118.dll windows:4 windows x86 arch:x86
6b22fe2a8f7d5b33d7261bfd49697282
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateFileA
GetModuleFileNameA
GetLastError
CreateMutexA
GetCurrentProcessId
GetModuleHandleA
WideCharToMultiByte
MultiByteToWideChar
TerminateProcess
ReadProcessMemory
CreateProcessA
VirtualAlloc
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
VirtualProtectEx
GetCurrentThreadId
GetCurrentProcess
WriteFile
DeleteFileA
InitializeCriticalSection
SetFilePointer
LeaveCriticalSection
EnterCriticalSection
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
Thread32Next
GetThreadPriority
Thread32First
CreateToolhelp32Snapshot
WriteProcessMemory
ReadFile
CloseHandle
GetCommandLineA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
IsBadReadPtr
ExitProcess
GetPrivateProfileStringA
TerminateThread
CreateThread
VirtualProtect
Sleep
user32
FindWindowA
GetWindowTextA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetWindowThreadProcessId
GetForegroundWindow
wininet
InternetCloseHandle
InternetReadFile
msvcrt
_initterm
malloc
_adjust_fdiv
_strupr
_stricmp
_strlwr
_strcmpi
free
sprintf
strlen
memcpy
strcpy
??2@YAPAXI@Z
strrchr
memset
strcat
atoi
??3@YAXPAX@Z
strncpy
strchr
strstr
fclose
fread
fopen
strcmp
wcslen
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ