Static task
static1
Behavioral task
behavioral1
Sample
404163a155e8e9739cfb3e230fafd718_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
404163a155e8e9739cfb3e230fafd718_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
404163a155e8e9739cfb3e230fafd718_JaffaCakes118
-
Size
28KB
-
MD5
404163a155e8e9739cfb3e230fafd718
-
SHA1
ba59f4c0d30a361fb1f842c2c79a643274b5ddd0
-
SHA256
583ac0620e3bea616727b3f0beafcd0606999eb8d9bcbe9f4f52914399a5e548
-
SHA512
14b6873263f5eec563fc9d0353aa9df1e9d68051942deb6d8100210cc92f6386f35be429f91b94cb1013a4fa2c2e5cac6b1b6b364e86aa9f5eb42b7d620c8f64
-
SSDEEP
384:X0+h4s1gZbSRt/0SknZwLrQPBWgcUg/EUQvdtcXZcyUdx8B7:k+h4s16bud/kA+Ug0/E5vn8ZcLLM7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 404163a155e8e9739cfb3e230fafd718_JaffaCakes118
Files
-
404163a155e8e9739cfb3e230fafd718_JaffaCakes118.dll windows:4 windows x86 arch:x86
97bc96ec191fe3aa24607d0b8dd7bcd6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
GetTempPathA
GetLastError
CreateMutexA
Sleep
WriteProcessMemory
VirtualProtectEx
OpenProcess
ResumeThread
OpenThread
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
GetProcAddress
LoadLibraryA
VirtualAllocEx
Thread32Next
Thread32First
CreateToolhelp32Snapshot
GetPrivateProfileStringA
lstrcpynA
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetFileSize
ReadFile
SetFilePointer
GetTempFileNameA
VirtualProtect
GetProcessHeap
HeapAlloc
OutputDebugStringA
GetCurrentThreadId
Process32Next
Process32First
WideCharToMultiByte
OpenMutexA
CreateFileA
WriteFile
CloseHandle
FreeResource
GetModuleFileNameA
CreateThread
msvcrt
_stricmp
??2@YAPAXI@Z
strcat
sprintf
_except_handler3
_strcmpi
??3@YAXPAX@Z
__CxxFrameHandler
memcpy
strrchr
__dllonexit
_onexit
_initterm
_adjust_fdiv
free
strcpy
memset
malloc
strncpy
strstr
strlen
wininet
InternetOpenUrlA
InternetOpenA
InternetReadFile
HttpQueryInfoA
InternetCloseHandle
user32
wvsprintfA
wsprintfA
FindWindowA
GetWindowThreadProcessId
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ