DW
Static task
static1
Behavioral task
behavioral1
Sample
3c4cbc22334f98fd15efd762209f3bc9_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3c4cbc22334f98fd15efd762209f3bc9_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3c4cbc22334f98fd15efd762209f3bc9_JaffaCakes118
-
Size
68KB
-
MD5
3c4cbc22334f98fd15efd762209f3bc9
-
SHA1
a7c2b628af5168d50e53d5e9785067b0957efae0
-
SHA256
8f412be5b894b41e6525c808cfc29e0d4baf74d0f20dfd43185f6bf95aa2a939
-
SHA512
276b235c8216d4acdac32f44860dab13d440077a19f68ce6f6558c6ecd59bc7c47880a857ef31c6235f6981068318b176de43774f5d6aa10f5bc3b30ff4ee39f
-
SSDEEP
768:c6orXcpWjsWTpYJm2XfvgaJE2OdfW9KM6xgQOv/0JHBsXl:c66sWTpYLXfvgkOdIhchs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c4cbc22334f98fd15efd762209f3bc9_JaffaCakes118
Files
-
3c4cbc22334f98fd15efd762209f3bc9_JaffaCakes118.dll windows:4 windows x86 arch:x86
06da970ffe6f45c860a082b957235809
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
SetLastError
GetLastError
WriteFile
SetFilePointer
WideCharToMultiByte
MultiByteToWideChar
IsBadReadPtr
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetCurrentProcessId
VirtualProtect
OutputDebugStringA
GetStdHandle
Module32First
CreateToolhelp32Snapshot
IsBadStringPtrA
FlushFileBuffers
LCMapStringW
LCMapStringA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
IsBadCodePtr
SetUnhandledExceptionFilter
GetModuleFileNameA
lstrcmpA
CreateThread
Sleep
Module32Next
HeapReAlloc
VirtualAlloc
RtlUnwind
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
HeapFree
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
user32
wsprintfA
SetWindowsHookExA
LoadIconA
LoadCursorA
RegisterClassA
MessageBoxA
CreateWindowExA
ShowWindow
GetMessageA
TranslateMessage
DispatchMessageA
UnhookWindowsHookEx
DefWindowProcA
BeginPaint
GetClientRect
DrawTextA
EndPaint
PostQuitMessage
CallNextHookEx
UpdateWindow
gdi32
GetStockObject
advapi32
RegOpenKeyExA
RegSetValueExA
RegCloseKey
shlwapi
StrStrIA
Exports
Exports
Sections
.text Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ