Static task
static1
Behavioral task
behavioral1
Sample
3a1b7e192c251caa9e1223ae0472a246_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3a1b7e192c251caa9e1223ae0472a246_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3a1b7e192c251caa9e1223ae0472a246_JaffaCakes118
-
Size
21KB
-
MD5
3a1b7e192c251caa9e1223ae0472a246
-
SHA1
88e9ddfe57eff5723079db67ae943df474789f51
-
SHA256
0b0d99cdab7936759a87226ac9feb6b382566675a7aff6e6ce220e7a80ec250d
-
SHA512
7040aa7aa4238615a234964c7fb207a9091336ab272174c5819b4da21a86f5a6669c505ee03c58549a8af74f47b8de44533e7b883cbe9f3892a2509ef628bf46
-
SSDEEP
384:b++kcJkLB3mA6NHxvHFgGfUsLFAzTR92J+:bHkB/6bCvsRAPL2J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a1b7e192c251caa9e1223ae0472a246_JaffaCakes118
Files
-
3a1b7e192c251caa9e1223ae0472a246_JaffaCakes118.dll windows:4 windows x86 arch:x86
e4720b2dd19f4ff47450c318eca44ca7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
CreateMutexA
OpenProcess
GetCurrentProcessId
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
LoadLibraryA
WriteProcessMemory
VirtualAllocEx
FindClose
FindNextFileA
lstrcpynA
lstrcpyA
lstrcmpA
FindFirstFileA
VirtualProtectEx
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
ReleaseMutex
Module32Next
Module32First
ReadFile
GetModuleFileNameA
WinExec
TerminateProcess
CreateThread
Sleep
GetCurrentProcess
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
Process32Next
GetSystemDirectoryA
lstrlenA
GetModuleHandleA
GetProcAddress
WriteFile
CloseHandle
GetTempPathA
GetTickCount
user32
EnumWindows
GetWindowThreadProcessId
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
wsprintfA
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
shlwapi
StrStrIA
wininet
InternetCloseHandle
msvcrt
_itoa
??2@YAPAXI@Z
memcpy
strcmp
_purecall
strstr
strncat
strcat
strlen
memset
strcpy
??3@YAXPAX@Z
memcmp
Sections
.bss Size: - Virtual size: 13KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: 1024B - Virtual size: 532B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ