Static task
static1
Behavioral task
behavioral1
Sample
4a90d3143a9f89f95b47390348125267_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4a90d3143a9f89f95b47390348125267_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4a90d3143a9f89f95b47390348125267_JaffaCakes118
-
Size
30KB
-
MD5
4a90d3143a9f89f95b47390348125267
-
SHA1
97ea36dcd4099a3af6ff230f48582f3bde564f44
-
SHA256
0edaa93037f79147038d1f593fec11ac89e62639239c17ed565bd608a4d5af25
-
SHA512
26c915959849a19aeff7d3ec2dc166b34a76259ddea563b0f83dc2fad52278fd34dc182241da95cd3d8c9ba7639c50508bf6809022c8d806ed6c7a7433113ce9
-
SSDEEP
384:MegEaZjKFR09t9PFMD2AQOZQerT/96cKEbAWwiVXrhP2DOQM5VPckWk2V6DmJ:BGZjxPFMDlxXrHAHiYO1DPcMc6qJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a90d3143a9f89f95b47390348125267_JaffaCakes118
Files
-
4a90d3143a9f89f95b47390348125267_JaffaCakes118.dll windows:4 windows x86 arch:x86
d1858f5797abb1aa9818aa7c718ef5f4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DeleteFileA
CloseHandle
ReadFile
CreateFileA
GetTempPathA
VirtualAlloc
GetPrivateProfileStringA
VirtualProtect
WriteFile
TerminateProcess
GetCurrentProcess
GetTickCount
ExitProcess
VirtualProtectEx
WideCharToMultiByte
LoadLibraryA
SetThreadContext
GetModuleHandleA
SetUnhandledExceptionFilter
ReadProcessMemory
CreateRemoteThread
VirtualAllocEx
OpenProcess
lstrlenA
GetModuleFileNameA
MultiByteToWideChar
CreateProcessA
GetSystemDirectoryA
GetCurrentThreadId
WriteProcessMemory
GetProcAddress
GetCurrentProcessId
CreateMutexA
GetLastError
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCommandLineA
IsBadReadPtr
TerminateThread
OpenThread
CreateThread
user32
SetWindowsHookExA
GetWindowThreadProcessId
CallNextHookEx
UnhookWindowsHookEx
GetWindowTextA
FindWindowA
wininet
InternetReadFile
InternetCloseHandle
msvcrt
malloc
_adjust_fdiv
_strnicmp
_strupr
_stricmp
_strlwr
_initterm
free
strchr
??2@YAPAXI@Z
memcpy
strrchr
memset
strcat
sprintf
strcpy
strlen
rand
srand
strcmp
strstr
fclose
fread
fopen
atoi
??3@YAXPAX@Z
strncpy
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ