Static task
static1
Behavioral task
behavioral1
Sample
4c6250eecbef54d0e11841b7f04db575_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4c6250eecbef54d0e11841b7f04db575_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4c6250eecbef54d0e11841b7f04db575_JaffaCakes118
-
Size
23KB
-
MD5
4c6250eecbef54d0e11841b7f04db575
-
SHA1
57e3606166c1c80f28160fdf9aff7fe3db44c101
-
SHA256
ab80a7c859e393831c4078ffbbdf3b67c4a19137c5d582ec93d4c35c460906a5
-
SHA512
d111ee33b2c4f0cd76f9a5c12292ad4251009a2929672cba726eebd01a08e7c1fc55312dab187280235f187f677ce3329fdcaafbb183f4dece42852f7ed87e1c
-
SSDEEP
384:RJqxeAqdGy5MsWON9W45XYxHKe/ZJlcSq44DqHAzrMoEBpCFDIwTjNDSm+d0271:DPAqdZMsB9r5XYxHnfYxUKM/KFfxK02h
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4c6250eecbef54d0e11841b7f04db575_JaffaCakes118
Files
-
4c6250eecbef54d0e11841b7f04db575_JaffaCakes118.dll windows:4 windows x86 arch:x86
235bf8e1d415fd98910ec2cf46b1b13b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
GetStartupInfoA
VirtualAlloc
InterlockedExchange
VirtualQuery
GetTickCount
LoadLibraryA
Sleep
SetLastError
IsDebuggerPresent
GetCurrentThreadId
GetProcessHeap
IsBadStringPtrA
IsBadWritePtr
VirtualProtect
user32
GetWindowInfo
GetWindow
GetTitleBarInfo
GetAncestor
CopyIcon
GetCursor
GetWindowContextHelpId
GetWindowRect
GetClientRect
IsCharUpperA
IsWindowVisible
GetWindowPlacement
IsChild
BlockInput
WindowFromDC
GetDC
GetWindowRgn
GetIconInfo
advapi32
IsValidSecurityDescriptor
AreAnyAccessesGranted
InitializeSecurityDescriptor
IsValidSid
msvcrt
_ltoa
srand
rand
ldiv
_adjust_fdiv
malloc
_initterm
free
memchr
_memccpy
_CIpow
_CIcosh
time
ldexp
frexp
_hypot
_pctype
_isctype
__mb_cur_max
__doserrno
div
_itoa
_CIfmod
gdi32
GetPixel
GetBkColor
GetStretchBltMode
ole32
CoGetCurrentProcess
CoRevertToSelf
shell32
ord66
ord680
ord64
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ