SmartMobilexx
Static task
static1
Behavioral task
behavioral1
Sample
3defbc1b1b65a6c86e3404c28c8938c4_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3defbc1b1b65a6c86e3404c28c8938c4_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3defbc1b1b65a6c86e3404c28c8938c4_JaffaCakes118
-
Size
156KB
-
MD5
3defbc1b1b65a6c86e3404c28c8938c4
-
SHA1
6b303f527eb85f0379d789f74eb4f265526c8b35
-
SHA256
8d2dd0659f61c32ebb81984ab2f2757675fce8945a2bd72b69978e244b3d7a96
-
SHA512
46bd3b5317779b182cdd4b5a7c007b3b288552dbcc3df0e0403bcb0ba90c6fddb943b7ff66fc4a0752272e3aa5f5ab3fab6d4a84f130892b18670c2d8eab38e7
-
SSDEEP
3072:ErOpKbNpU3l/WpXhDdIdn4gJwUuIX+OsVlJgrp/+9GdcekvbupkAsX:5wA1oRxy4QXgb8p+4cekvZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3defbc1b1b65a6c86e3404c28c8938c4_JaffaCakes118
Files
-
3defbc1b1b65a6c86e3404c28c8938c4_JaffaCakes118.dll windows:4 windows x86 arch:x86
a2eda37511f0e932b74e778ff8b6a632
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateProcessA
GetModuleHandleA
WriteFile
LoadLibraryA
WriteProcessMemory
GetCurrentProcess
InterlockedIncrement
ExitProcess
CreateFileA
HeapFree
InterlockedCompareExchange
MapViewOfFile
LeaveCriticalSection
InterlockedDecrement
GetCommandLineA
HeapAlloc
GlobalFree
GetVolumeInformationA
UnmapViewOfFile
OpenEventA
LocalFree
GetTickCount
CreateFileMappingA
CloseHandle
TerminateProcess
OpenFileMappingA
CreateEventA
EnterCriticalSection
CreateDirectoryA
GetModuleFileNameA
SetLastError
GetComputerNameA
GetProcAddress
GetProcessHeap
Sleep
CreateMutexW
ReadProcessMemory
CopyFileA
WaitForSingleObject
GlobalAlloc
GetLastError
ole32
OleCreate
CoTaskMemAlloc
OleSetContainedObject
CoCreateInstance
CoCreateGuid
CoSetProxyBlanket
CoInitialize
CoUninitialize
user32
TranslateMessage
PostQuitMessage
SetWindowLongA
SetWindowsHookExA
GetWindowLongA
GetMessageA
DispatchMessageA
GetSystemMetrics
KillTimer
GetWindowThreadProcessId
GetParent
GetWindow
GetCursorPos
ClientToScreen
DestroyWindow
CreateWindowExA
PeekMessageA
UnhookWindowsHookEx
GetClassNameA
DefWindowProcA
FindWindowA
ScreenToClient
RegisterWindowMessageA
SetTimer
SendMessageA
oleaut32
SysAllocString
SysStringLen
SysFreeString
SysAllocStringLen
shlwapi
UrlUnescapeW
StrStrIW
advapi32
OpenProcessToken
RegCloseKey
GetUserNameA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
DuplicateTokenEx
RegDeleteKeyA
SetTokenInformation
RegQueryValueExA
RegOpenKeyExA
shell32
SHGetFolderPathA
Exports
Exports
Sections
.text Size: 124KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 940B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gqhw Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ