LOAD
Static task
static1
Behavioral task
behavioral1
Sample
4c6a2c7a2811073d4e439d9d0c7e289a_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4c6a2c7a2811073d4e439d9d0c7e289a_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4c6a2c7a2811073d4e439d9d0c7e289a_JaffaCakes118
-
Size
1.2MB
-
MD5
4c6a2c7a2811073d4e439d9d0c7e289a
-
SHA1
6f55bb6c7fe9676a32e54b91ab1aa042c70ae6df
-
SHA256
816695b4f013541505161d8a98a408cb6f285f2136248ef81abf1c39df4d0c39
-
SHA512
d6ad315c87758099eabd05490360774c1cdb94886112cf6815a0d2d6b91edfc2f3f6235e8e2695e218885f2bcd7ef139ad39b835b95bf35f4cb5d25d122e24fb
-
SSDEEP
3072:Jt+2KbSM27pnOM5lS6sV0MnHGCw2mWQdqooLLCcKI:OSnxOM5lS6w0knw2jUOh1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4c6a2c7a2811073d4e439d9d0c7e289a_JaffaCakes118
Files
-
4c6a2c7a2811073d4e439d9d0c7e289a_JaffaCakes118.dll windows:4 windows x86 arch:x86
500badf50861548f59daf26fcf767ccc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcessVersion
GetCPInfo
GetOEMCP
RtlUnwind
GetCommandLineA
HeapAlloc
HeapFree
RaiseException
HeapSize
HeapReAlloc
ExitProcess
TerminateProcess
GetACP
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetStdHandle
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
GlobalFlags
lstrcmpA
LoadLibraryA
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetProcAddress
GetLastError
GetVersion
lstrcpynA
lstrcpyA
lstrcatA
SetErrorMode
TlsGetValue
LocalReAlloc
Beep
TlsSetValue
EnterCriticalSection
GlobalAlloc
GlobalReAlloc
GlobalLock
LeaveCriticalSection
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
GetCurrentThreadId
SetLastError
FreeLibrary
LocalFree
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
VirtualQueryEx
VirtualProtectEx
WriteProcessMemory
TerminateThread
GetCurrentProcess
GetTickCount
CreateThread
GetWindowsDirectoryA
SetFileAttributesA
Sleep
CloseHandle
GetModuleHandleA
GetModuleFileNameA
WritePrivateProfileSectionA
GetPrivateProfileSectionA
GetFileAttributesA
GetLocalTime
lstrlenA
GetStdHandle
user32
SetWindowTextA
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
ClientToScreen
TabbedTextOutA
DrawTextA
GrayStringA
GetClassNameA
PtInRect
LoadCursorA
GetSysColorBrush
PostQuitMessage
DestroyMenu
MapWindowPoints
GetSysColor
GetFocus
SetFocus
AdjustWindowRectEx
GetTopWindow
GetCapture
LoadIconA
wsprintfA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextA
GetDlgCtrlID
DefWindowProcA
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
GetWindow
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
LoadStringA
UnregisterClassA
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExA
PeekMessageA
DispatchMessageA
PostMessageA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
CopyRect
GetClientRect
GetDC
EnableWindow
MessageBoxA
GetWindowThreadProcessId
KillTimer
SetTimer
GetKeyState
WinHelpA
GetWindowDC
ReleaseDC
SendMessageA
gdi32
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetDeviceCaps
PtVisible
RectVisible
ExtTextOutA
Escape
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
DeleteObject
TextOutA
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
comctl32
ord17
wsock32
gethostbyname
gethostname
ntohs
inet_addr
getpeername
WSASetLastError
accept
ioctlsocket
WSACleanup
htons
htonl
closesocket
recv
send
WSAAsyncSelect
inet_ntoa
socket
recvfrom
sendto
connect
WSAStartup
WSAGetLastError
listen
shutdown
bind
wininet
InternetCloseHandle
InternetOpenUrlA
InternetCanonicalizeUrlA
InternetGetConnectedState
InternetOpenA
InternetReadFile
Exports
Exports
Sections
.text Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ