Static task
static1
Behavioral task
behavioral1
Sample
32c54da0c1d1809427cd470e223e4291_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
32c54da0c1d1809427cd470e223e4291_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
32c54da0c1d1809427cd470e223e4291_JaffaCakes118
-
Size
1.0MB
-
MD5
32c54da0c1d1809427cd470e223e4291
-
SHA1
1cfbeea3049dcc6df450b0c170b5c14c280279c1
-
SHA256
b462743ab2471efdad02c56779a6d53ed19b6785f58d6289583a9072e6baacf5
-
SHA512
62f3afb04b07defe8d1932a6273574e79330b7e67eea0af034f87ba951d7b5e910bad1eb32c1e467750a1f05983a62edc150d93849129ba634cfd8a3e52fa678
-
SSDEEP
24576:XxnKB8xheP3xeDx9K8zsiteJwdyr+lCnmfBu:tMNfCbK8QioOQnmfBu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32c54da0c1d1809427cd470e223e4291_JaffaCakes118
Files
-
32c54da0c1d1809427cd470e223e4291_JaffaCakes118.dll windows:4 windows x86 arch:x86
1c9fd87e3738a28d8ab6f48b3c011152
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
IsDBCSLeadByte
LoadLibraryA
InterlockedDecrement
GetModuleFileNameA
GetProcAddress
GetStartupInfoA
Sleep
MulDiv
GetSystemTimeAsFileTime
VirtualAlloc
VirtualProtect
QueryPerformanceFrequency
IsDebuggerPresent
SetLastError
GetLastError
GetCurrentProcess
IsBadStringPtrA
GetProcessHeap
IsBadReadPtr
GetUserDefaultLCID
user32
GetCursor
GetWindowRect
GetClientRect
GetWindowTextLengthA
GetWindowTextA
IsCharUpperA
GetWindowDC
GetDC
WindowFromDC
GetIconInfo
GetAncestor
GetWindowInfo
GetWindowThreadProcessId
IsWindowVisible
GetParent
BlockInput
SetLastErrorEx
IsChild
IsWindowUnicode
advapi32
IsValidAcl
GetUserNameA
msvcrt
_adjust_fdiv
malloc
_initterm
free
_memicmp
_CIcosh
memchr
srand
_CIfmod
_set_error_mode
_CIacos
localeconv
_pctype
_isctype
__mb_cur_max
modf
_errno
_CIsinh
gdi32
GetBitmapDimensionEx
GetBkColor
GetStretchBltMode
GdiGetBatchLimit
GetPixel
ole32
CoGetCurrentProcess
shell32
ord524
ord66
ord680
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ