Static task
static1
Behavioral task
behavioral1
Sample
46b192bff3de1faa093aa491858afd45_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
46b192bff3de1faa093aa491858afd45_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
46b192bff3de1faa093aa491858afd45_JaffaCakes118
-
Size
14KB
-
MD5
46b192bff3de1faa093aa491858afd45
-
SHA1
d8cdf91fd42d41be5d801be18077b0921daf7fc1
-
SHA256
39ef296f4d4498701163854cae7875f86dae8cad6a1d3bded16e2db21522e308
-
SHA512
faed1ec824d47171686ef9e1e0a8bbe9d5819d6c6300cb1ffefd212a0558f211de3743c6c04bf0a40dbcb0d84b3e9bf2b2beea30fcb60a142b82f406df94cb48
-
SSDEEP
384:fuN7znMcRKQ1XwCxtRPbo5PMy01RHlHNl24L:fuNquwCxtRPb0PMD1hhNl24L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 46b192bff3de1faa093aa491858afd45_JaffaCakes118
Files
-
46b192bff3de1faa093aa491858afd45_JaffaCakes118.dll windows:4 windows x86 arch:x86
463fd16fe6055b3ceba23b0fbc8b320f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WriteFile
OpenEventA
Sleep
GetFileSize
ReadFile
GetModuleFileNameA
GetCurrentProcessId
VirtualProtectEx
ReadProcessMemory
GetCurrentProcess
CreateEventA
CreateFileA
CreateThread
OutputDebugStringA
CopyFileA
GetComputerNameA
ExitProcess
TerminateProcess
IsBadReadPtr
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
DeleteFileA
GetModuleHandleA
GetProcAddress
OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
CreateRemoteThread
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
VirtualFree
SetThreadPriority
VirtualAlloc
user32
GetWindowTextA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DrawIcon
CheckMenuItem
CheckMenuRadioItem
CheckRadioButton
CheckDlgButton
FindWindowA
GetWindowThreadProcessId
wsprintfA
GetInputState
PostThreadMessageA
GetMessageA
DeleteMenu
gdi32
Chord
Arc
ArcTo
BitBlt
DeleteObject
CancelDC
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
wininet
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 866B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ