Static task
static1
Behavioral task
behavioral1
Sample
4d378af49aeee99c81c1404a94179ce9_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4d378af49aeee99c81c1404a94179ce9_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4d378af49aeee99c81c1404a94179ce9_JaffaCakes118
-
Size
23KB
-
MD5
4d378af49aeee99c81c1404a94179ce9
-
SHA1
cd9f49cca0bd500b8c7373888ba5f85149d0c970
-
SHA256
a690010ca66b7e3c83c9460916fe56bac852a1d81a9359522eb510adcd78bf53
-
SHA512
0370601fb49e6ac7f2e760ba2d5e6039f9cafc2cce09fbcd7ae33b40c0159a546657637a8f23c383e85f573931e7408b96e20bc271992c33939084c60ff9f6d6
-
SSDEEP
384:hiAWzPYFbYi6QgTSXv8T8bfH5HxTxp30lTbE2m0+muoSa1VTw:MpDYxj6QgS/RFb0lfR+muoS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d378af49aeee99c81c1404a94179ce9_JaffaCakes118
Files
-
4d378af49aeee99c81c1404a94179ce9_JaffaCakes118.dll windows:4 windows x86 arch:x86
56eee830eee29285ee4cdb5f72a01894
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
InitializeCriticalSection
TerminateProcess
GetCurrentProcessId
TerminateThread
IsBadReadPtr
GetPrivateProfileStringA
RaiseException
CloseHandle
GetCurrentThread
Process32Next
Process32First
CreateToolhelp32Snapshot
GlobalAlloc
LoadLibraryA
ReadProcessMemory
WriteProcessMemory
GlobalLock
GlobalUnlock
GlobalFree
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleA
GetProcAddress
GetCurrentProcess
VirtualProtectEx
CreateMutexA
GetModuleFileNameA
CreateThread
OpenMutexA
WideCharToMultiByte
user32
FindWindowA
GetWindowThreadProcessId
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
ws2_32
WSASetLastError
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
msvcrt
??3@YAXPAX@Z
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
wcslen
fopen
fread
fclose
strrchr
memcpy
strcpy
atoi
strchr
memset
strcat
sprintf
??2@YAPAXI@Z
strncpy
_strlwr
sscanf
strlen
strstr
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ