Static task
static1
Behavioral task
behavioral1
Sample
4c3c5af04d9b9a6c34da7d224b6bdd60_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4c3c5af04d9b9a6c34da7d224b6bdd60_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4c3c5af04d9b9a6c34da7d224b6bdd60_JaffaCakes118
-
Size
25KB
-
MD5
4c3c5af04d9b9a6c34da7d224b6bdd60
-
SHA1
ea12ca915bface15f2b49b93872c65a440da7c34
-
SHA256
4248caddde2f3e927a73429f7aa5ea6a096952927f84e0b0a309ceed91abf8d3
-
SHA512
79458e681d00017ccb79f35fb1b7ac9343d1c84e91447ce428f0559da584853866e6af5a706942f0e27a505ae29035ee0437240789d37072056e0ca8040a5aa4
-
SSDEEP
768:H3hOXY7MqZxqJVFGLEN83RnxsVoC5Luixl5CTD:TDZxqJQM8ViZCTD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4c3c5af04d9b9a6c34da7d224b6bdd60_JaffaCakes118
Files
-
4c3c5af04d9b9a6c34da7d224b6bdd60_JaffaCakes118.dll windows:4 windows x86 arch:x86
e2b0bd2b6fe86375d7b3672a473a331c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalLock
GlobalAlloc
Sleep
InitializeCriticalSection
TerminateProcess
TerminateThread
IsBadReadPtr
GetPrivateProfileStringA
RaiseException
WideCharToMultiByte
ReadProcessMemory
GetModuleHandleA
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
GlobalUnlock
Process32Next
Process32First
CreateToolhelp32Snapshot
WriteProcessMemory
GlobalFree
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
GetCurrentProcess
GetCurrentThreadId
VirtualProtectEx
GetModuleFileNameA
CreateThread
GetCurrentProcessId
OpenMutexA
CreateMutexA
GetCurrentThread
user32
GetWindowTextA
GetForegroundWindow
FindWindowA
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetWindowThreadProcessId
ws2_32
WSASetLastError
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
msvcrt
strncpy
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
wcslen
fopen
fread
fclose
strstr
strcat
sprintf
strcpy
memcpy
strrchr
atoi
strchr
memset
??2@YAPAXI@Z
_strupr
??3@YAXPAX@Z
sscanf
strlen
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ