Static task
static1
Behavioral task
behavioral1
Sample
304960418ebd6a67b22d2b07c32eaf8f_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
304960418ebd6a67b22d2b07c32eaf8f_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
304960418ebd6a67b22d2b07c32eaf8f_JaffaCakes118
-
Size
12KB
-
MD5
304960418ebd6a67b22d2b07c32eaf8f
-
SHA1
42ac0795c436b379592e71573320e2543e3f5c75
-
SHA256
ad1df228f8eb72027b4ae675c2936f55dec4604d0d0815a38587621f3688b61b
-
SHA512
729a3a928c51f284cd904976cb93239360e728634759b7bb160e08e23078ca20f135a60638fe2a35f0155db7b88540aa70933b874edb7870eb16fb82a539b29e
-
SSDEEP
192:C58r33iuoUY6o0+p3sprQXk4XWyZuyzbm1w/Dvb:C58r2z6zg4rK8yvQw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 304960418ebd6a67b22d2b07c32eaf8f_JaffaCakes118
Files
-
304960418ebd6a67b22d2b07c32eaf8f_JaffaCakes118.dll windows:4 windows x86 arch:x86
dfbd983805d40876ee4635890be5d7f2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ReadProcessMemory
GlobalFree
GlobalLock
GlobalAlloc
GetCurrentProcess
GetModuleFileNameA
VirtualProtectEx
GetPrivateProfileStringA
WideCharToMultiByte
CreateThread
WriteProcessMemory
CloseHandle
user32
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
wsprintfA
advapi32
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
wininet
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 594B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ