Static task
static1
Behavioral task
behavioral1
Sample
395308fabfad1d6188c68f80c73576a1_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
395308fabfad1d6188c68f80c73576a1_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
395308fabfad1d6188c68f80c73576a1_JaffaCakes118
-
Size
18KB
-
MD5
395308fabfad1d6188c68f80c73576a1
-
SHA1
00ae69b1101969bcfbcdefa7693e009b671bdd72
-
SHA256
bf71ed57123c412feec81c40316373c89e8043287c110f2b14fd1dbcb0d20df5
-
SHA512
7ba857c19d7d56130d2965a28af58594769a3d0ba218e66c70080abd86ceb1125624e662d3019c548def0ca87375876d1c20faca1c3fa33cd3fbea9d6aa169cd
-
SSDEEP
384:YCe8w92yAxvaAYxOG2aZRljLS0tyFB01ywx9NS:YCen2yAxvaAYxX1ZPLScyz01nxi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 395308fabfad1d6188c68f80c73576a1_JaffaCakes118
Files
-
395308fabfad1d6188c68f80c73576a1_JaffaCakes118.dll windows:4 windows x86 arch:x86
8285066e32eaa308396d50338177ca9d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
DeleteFileA
CreateFileA
WriteFile
OpenEventA
Sleep
GetFileSize
ReadFile
GetModuleFileNameA
VirtualProtectEx
ReadProcessMemory
GetCurrentProcess
GetProcAddress
CopyFileA
GetCurrentThread
GetCurrentProcessId
CreateEventA
SetThreadPriority
CreateThread
GlobalLock
GlobalAlloc
IsBadReadPtr
ExitProcess
OpenProcess
VirtualAllocEx
VirtualAlloc
WriteProcessMemory
VirtualFreeEx
CreateRemoteThread
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
VirtualFree
OutputDebugStringA
user32
GetKeyboardState
GetKeyState
EnumChildWindows
SendMessageA
GetForegroundWindow
GetClassNameA
IsWindowEnabled
IsWindowVisible
FindWindowExA
FindWindowA
GetWindowThreadProcessId
GetWindowTextA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
MapVirtualKeyA
ToAscii
GetClientRect
ClientToScreen
ReleaseDC
GetCursor
GetDC
GetDCEx
GetDesktopWindow
wsprintfA
PostThreadMessageA
GetMessageA
GetInputState
gdi32
GetBkColor
GetPixel
GetBkMode
advapi32
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
wininet
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 982B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ