Static task
static1
Behavioral task
behavioral1
Sample
2d3c68916949b65c6ffe437e8e2a0432_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2d3c68916949b65c6ffe437e8e2a0432_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2d3c68916949b65c6ffe437e8e2a0432_JaffaCakes118
-
Size
224KB
-
MD5
2d3c68916949b65c6ffe437e8e2a0432
-
SHA1
b75c06ca5914fa2797890e0fcaa2bc1332c0f7b7
-
SHA256
62e6b72058b543fdfb6925589197f48c60f3df8f129cdfaf596e487132ada60d
-
SHA512
e543e7efa9aa50505ff7e2c70919f7bace447a4e8f8f1b626388fca1fcb24f7c54261df2b87d71497b4bb20ba9513f69c9461185549782a485aa249377d45b30
-
SSDEEP
768:v3Iv5irQLtzKZM0LKnqnN8vOJ3tCIYBBQARQkI2pNX:aMCtZOJ3t+BBQARY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d3c68916949b65c6ffe437e8e2a0432_JaffaCakes118
Files
-
2d3c68916949b65c6ffe437e8e2a0432_JaffaCakes118.dll windows:4 windows x86 arch:x86
c0c5dd0bf02c0605b2d649d2817066df
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
isdigit
_snprintf
RtlZeroMemory
RtlUnwind
memcmp
memcpy
strlen
strstr
ws2_32
gethostname
closesocket
kernel32
CreateFileA
IsBadReadPtr
lstrcpynA
WriteFile
WideCharToMultiByte
VirtualProtectEx
VirtualFree
VirtualAlloc
UnmapViewOfFile
ReadFile
MoveFileExA
CloseHandle
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetCurrentDirectoryA
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetSystemDirectoryA
GlobalAlloc
GlobalFree
LeaveCriticalSection
LoadLibraryA
Sleep
TerminateThread
WaitForSingleObject
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrlenA
WritePrivateProfileStringA
MapViewOfFile
CreateFileMappingA
CreateProcessA
DeleteFileA
GetExitCodeThread
GetFileSize
GetLastError
GetStartupInfoA
GetTempFileNameA
GetTempPathA
user32
SetTimer
SendMessageA
RegisterWindowMessageA
KillTimer
GetWindowThreadProcessId
FindWindowA
CallNextHookEx
wsprintfA
UnhookWindowsHookEx
Sections
.text Size: 208KB - Virtual size: 204KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 12B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ