Static task
static1
Behavioral task
behavioral1
Sample
3659491249e15ee00c0d444195e336cc_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3659491249e15ee00c0d444195e336cc_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3659491249e15ee00c0d444195e336cc_JaffaCakes118
-
Size
19KB
-
MD5
3659491249e15ee00c0d444195e336cc
-
SHA1
af8818d8795618cb1c148eaf7748ed49a85c8ced
-
SHA256
676ced3a84425056053688be6ccfb87b3403a42343c5973c75cd7772d7eea803
-
SHA512
701c85faaf8fe0d93a0432e316ce7d6e55b8ed1b3e43c8b57c850726efb613f8b5e19fd5ce3a52270e67c6a3d02a68d5283e2ebe0e3f9cd8248a85a6fbc6cad2
-
SSDEEP
384:774B+/sAHV2NbTWj24FDdnafHpo6w3cDqy72kvq+cisOW9jw:7lbHV2JSZFBOh0cDfSQsOW9E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3659491249e15ee00c0d444195e336cc_JaffaCakes118
Files
-
3659491249e15ee00c0d444195e336cc_JaffaCakes118.dll windows:4 windows x86 arch:x86
cf9204511e398c483fbab986b0160a64
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalUnlock
GlobalLock
GlobalAlloc
Thread32Next
GetThreadPriority
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetPrivateProfileStringA
IsBadReadPtr
ExitProcess
RaiseException
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
GlobalFree
GetModuleHandleA
ReadProcessMemory
SetThreadContext
SetUnhandledExceptionFilter
WriteProcessMemory
Sleep
SetThreadPriority
WaitForSingleObject
CloseHandle
GetCurrentProcess
GetCurrentThreadId
VirtualProtectEx
GetModuleFileNameA
CreateThread
TerminateThread
GetCurrentProcessId
CreateMutexA
LoadLibraryA
GetLastError
user32
GetWindowThreadProcessId
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetForegroundWindow
GetWindowTextA
FindWindowA
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
msvcrt
free
_initterm
_stricmp
malloc
_adjust_fdiv
_strlwr
fopen
fread
fclose
strstr
strcat
sprintf
strcpy
memcpy
strrchr
memset
strlen
??2@YAPAXI@Z
strcmp
wcslen
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 153B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ