Static task
static1
Behavioral task
behavioral1
Sample
466b24feed3c6897b5623b8e694f5792_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
466b24feed3c6897b5623b8e694f5792_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
466b24feed3c6897b5623b8e694f5792_JaffaCakes118
-
Size
160KB
-
MD5
466b24feed3c6897b5623b8e694f5792
-
SHA1
44f438f54a257755fe27d50561b3815951f398d0
-
SHA256
125113537783310410a4a4a04961e0649ef4e55108ef86af3ccfee4be5bf6efa
-
SHA512
55988e71bdeeaf2f7ee2b08c7d66d6d62f12d586cdc6ffe74724858b23fd977ab585fa483155e277edb920e6945338649aa9cc22e800721f726bc40e122949a2
-
SSDEEP
3072:eafJttKIr30Ql0rGXGuorAKDd48pBIxnynQ50fu7oKME7mJdLM:eGJj3j0Q+2dGD7IxF50lE7mJdo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 466b24feed3c6897b5623b8e694f5792_JaffaCakes118
Files
-
466b24feed3c6897b5623b8e694f5792_JaffaCakes118.dll windows:4 windows x86 arch:x86
7f1e4f1ec9e337450d7880773f5fa3e9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersion
MulDiv
GetLocalTime
GetProcAddress
VirtualProtect
DosDateTimeToFileTime
GetModuleFileNameA
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
GetACP
LoadLibraryA
GetVersionExA
Sleep
IsDebuggerPresent
GetComputerNameA
IsBadWritePtr
VirtualAlloc
user32
GetTopWindow
GetWindow
GetTitleBarInfo
CopyIcon
WindowFromDC
IsClipboardFormatAvailable
GetCursor
GetMenuContextHelpId
GetWindowContextHelpId
GetWindowTextLengthA
IsIconic
GetGUIThreadInfo
GetWindowPlacement
IsChild
IsMenu
BlockInput
GetWindowRgn
GetWindowTextA
GetWindowDC
advapi32
GetUserNameA
IsValidAcl
InitializeSecurityDescriptor
IsValidSecurityDescriptor
RevertToSelf
msvcrt
_CIfmod
_itoa
__doserrno
_adjust_fdiv
malloc
_initterm
free
memchr
srand
_set_error_mode
_CIacos
time
localeconv
_pctype
_isctype
__mb_cur_max
modf
_errno
ldiv
gdi32
GetPixel
GetBkColor
GetBkMode
GetBitmapDimensionEx
GetStretchBltMode
ole32
CoGetCurrentProcess
CoDosDateTimeToFileTime
CoRevertToSelf
shell32
ord680
ord524
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ