Static task
static1
Behavioral task
behavioral1
Sample
3cbaca99d6e9bb7ada8ef18f48375e1b_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3cbaca99d6e9bb7ada8ef18f48375e1b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3cbaca99d6e9bb7ada8ef18f48375e1b_JaffaCakes118
-
Size
22KB
-
MD5
3cbaca99d6e9bb7ada8ef18f48375e1b
-
SHA1
b1f0fe3ad38a861cd074f1aef241814499dc59dc
-
SHA256
ea33fbdbbf2ccb8ecf83210b0f4da5412a7a896b4ebd2bb8fcecbc8d3ac81913
-
SHA512
3b9b9414e785b395f19cb3c5145841c0c84a221477bbbb2e47ac7e4be8c8ca4ec7719f38c1b208650277d7f0925afc05c81293992e3442197ddb4c1931f6eded
-
SSDEEP
384:GKhTkfZOmSKtlKmBi2o04hWUuKzbb/7d:jFLeBBiv040UuKz/jd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3cbaca99d6e9bb7ada8ef18f48375e1b_JaffaCakes118
Files
-
3cbaca99d6e9bb7ada8ef18f48375e1b_JaffaCakes118.dll windows:4 windows x86 arch:x86
4a9559cccdb599a4880636401405ae71
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FindResourceA
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetLastError
CreateMutexA
Sleep
WriteProcessMemory
VirtualProtectEx
OpenProcess
CreateThread
ResumeThread
OpenThread
GetModuleFileNameA
VirtualFreeEx
WaitForSingleObject
VirtualAllocEx
Thread32Next
Thread32First
CreateToolhelp32Snapshot
GetPrivateProfileStringA
lstrcpynA
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
LoadResource
ReadFile
SetFilePointer
VirtualProtect
GetProcessHeap
HeapAlloc
WideCharToMultiByte
LockResource
SizeofResource
CreateFileA
WriteFile
CloseHandle
GetFileSize
FreeResource
msvcrt
__CxxFrameHandler
memcpy
_except_handler3
strcat
__dllonexit
_onexit
_initterm
_adjust_fdiv
_strcmpi
free
strlen
??2@YAPAXI@Z
memset
strncpy
malloc
??3@YAXPAX@Z
user32
wsprintfA
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ