Static task
static1
Behavioral task
behavioral1
Sample
441edfa0b4d7e7f40784b879ec6fe5db_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
441edfa0b4d7e7f40784b879ec6fe5db_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
441edfa0b4d7e7f40784b879ec6fe5db_JaffaCakes118
-
Size
21KB
-
MD5
441edfa0b4d7e7f40784b879ec6fe5db
-
SHA1
a2b46f27061ff96d703be162c23dea820c660e7b
-
SHA256
776dc69f0452b126930d4d5cd7c1a8d007311f6ffef82962698d2776ea22cc89
-
SHA512
d3a0c4a0eb0aa40f83d7c2ed09a77e0b75fe900c5e893fb1ad29c72577fc3c79494c747d017291f345c855a9adfe2bc8a33ab2778d7896c4d676a6872df61106
-
SSDEEP
384:+zERW/J52w1k/qddNuqVKiNGJsfiAqL2M5K3jEHFda6/yZ:+D1/YCGhjK3jEvz/yZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 441edfa0b4d7e7f40784b879ec6fe5db_JaffaCakes118
Files
-
441edfa0b4d7e7f40784b879ec6fe5db_JaffaCakes118.dll windows:4 windows x86 arch:x86
36d89746014d5dbd11ca6bec493c412e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalAlloc
GetCurrentThread
GetProcAddress
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
RaiseException
InitializeCriticalSection
GetPrivateProfileStringA
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GlobalLock
LoadLibraryA
ReadProcessMemory
WriteProcessMemory
GetModuleHandleA
GlobalUnlock
GlobalFree
GetCommandLineA
IsBadReadPtr
Sleep
GetModuleFileNameA
OpenMutexA
CreateMutexA
TerminateThread
CreateThread
GetCurrentProcess
GetCurrentProcessId
VirtualProtectEx
user32
FindWindowA
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetAsyncKeyState
ToUnicode
GetKeyboardState
GetWindowThreadProcessId
advapi32
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
msvcrt
strstr
_stricmp
_adjust_fdiv
malloc
_initterm
free
wcslen
memset
fopen
fread
fclose
sscanf
strlen
strrchr
strcmp
strcat
sprintf
strcpy
??2@YAPAXI@Z
strncpy
_strlwr
memcpy
??3@YAXPAX@Z
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ