Static task
static1
Behavioral task
behavioral1
Sample
46674ea20b042c662a5d706998e89c98_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
46674ea20b042c662a5d706998e89c98_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
46674ea20b042c662a5d706998e89c98_JaffaCakes118
-
Size
760KB
-
MD5
46674ea20b042c662a5d706998e89c98
-
SHA1
f40937ef5585d9d3bd7a7b1c1d1428d9ad2efb4f
-
SHA256
16eb55f717f51d5bbd1d664dcf2f48ff40eaec414d94991c6b2ef774d6d5ef7a
-
SHA512
53e4987200a48212eb057177665ac831003728490894c8b86c944ba18c6c3b0d98395f6c831f0aedf0569778e89ce09cbf98ebb464cdb51368be7eafad470d71
-
SSDEEP
192:C6lWrsXpMacvjkLuiLCA+x4ic+wxXSGghX8cptcK7HAXQeU+na+Xzh2ZMCqoSBp2:C6PMWfrivwypaK9NkXwysu96KwKZy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 46674ea20b042c662a5d706998e89c98_JaffaCakes118
Files
-
46674ea20b042c662a5d706998e89c98_JaffaCakes118.dll windows:4 windows x86 arch:x86
f84058b325a2f3c6baa6b1b4d412ab19
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateFileA
GetPrivateProfileStringA
GetCurrentProcessId
GetTickCount
IsBadReadPtr
GetProcAddress
LoadLibraryA
SetFilePointer
HeapAlloc
GetProcessHeap
VirtualProtect
ExitProcess
GetFileSize
GetModuleHandleA
WideCharToMultiByte
GetCommandLineA
ReadFile
SetEvent
CloseHandle
GetModuleFileNameA
Sleep
GetCurrentProcess
TerminateProcess
OpenEventA
CreateEventA
CreateThread
user32
BroadcastSystemMessageA
GetWindowLongA
wsprintfA
wvsprintfA
FindWindowExA
GetWindowThreadProcessId
GetWindowTextA
IsWindowVisible
FindWindowA
CallNextHookEx
SetWindowsHookExA
advapi32
RegSetValueExA
RegSetValueA
RegCreateKeyA
RegOpenKeyA
RegCloseKey
RegQueryValueExA
shell32
StrRStrIA
ws2_32
closesocket
msvcrt
memcpy
realloc
_strlwr
_initterm
_adjust_fdiv
_strcmpi
_except_handler3
strcmp
fopen
fseek
ftell
strcpy
strcat
strlen
free
strncpy
strchr
strstr
memset
malloc
strrchr
sprintf
isdigit
isalpha
_strupr
fclose
fread
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 402KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ