CatDBPathWan
Static task
static1
Behavioral task
behavioral1
Sample
4dc5733b2c26287a71ae53e3852a982f_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4dc5733b2c26287a71ae53e3852a982f_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4dc5733b2c26287a71ae53e3852a982f_JaffaCakes118
-
Size
152KB
-
MD5
4dc5733b2c26287a71ae53e3852a982f
-
SHA1
f8f7c18fb50fe35495e8998f2c20922449074fc3
-
SHA256
1f0cb9d25d64314e3870ed2f18c22c5422852a6a5d45b7ade6608737f4176300
-
SHA512
f1ac6415e64e36a769a9c5109f0f4dd1732a6f71ea7ee2227cff9a81912ad6775c7067e2447be6416cece82c5878a8747486987624529894118fb5510b25a7be
-
SSDEEP
3072:CQx3rpohXz5iM1FuC5tyF51gE9ZKVp6vMl+OuxtAOM1ABAny:HJNEXdnFD5tyH1b4poFOwvIAOy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4dc5733b2c26287a71ae53e3852a982f_JaffaCakes118
Files
-
4dc5733b2c26287a71ae53e3852a982f_JaffaCakes118.dll windows:4 windows x86 arch:x86
09167ea461791351bb4368e62ab946dc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalFree
TerminateProcess
CreateProcessA
ReadProcessMemory
OpenEventA
LeaveCriticalSection
CreateEventA
GetCurrentProcess
EnterCriticalSection
WriteProcessMemory
CreateFileA
GetVolumeInformationA
OpenFileMappingA
WriteFile
GetModuleHandleA
GlobalAlloc
GetLastError
Sleep
InterlockedDecrement
InterlockedCompareExchange
CopyFileA
InterlockedIncrement
CreateFileMappingA
GetModuleFileNameA
WaitForSingleObject
GetProcAddress
GetCommandLineA
GetTickCount
CreateDirectoryA
SetLastError
GetProcessHeap
GetComputerNameA
UnmapViewOfFile
MapViewOfFile
LocalFree
LoadLibraryA
CreateMutexW
HeapFree
CloseHandle
HeapAlloc
ExitProcess
ole32
CoCreateGuid
OleSetContainedObject
OleCreate
CoInitialize
CoSetProxyBlanket
CoCreateInstance
CoTaskMemAlloc
CoUninitialize
user32
GetParent
SetWindowLongA
GetMessageA
TranslateMessage
GetClassNameA
SetTimer
PostQuitMessage
ClientToScreen
GetWindow
ScreenToClient
GetSystemMetrics
UnhookWindowsHookEx
KillTimer
CreateWindowExA
SetWindowsHookExA
GetCursorPos
DestroyWindow
DispatchMessageA
RegisterWindowMessageA
GetWindowThreadProcessId
FindWindowA
GetWindowLongA
DefWindowProcA
SendMessageA
PeekMessageA
oleaut32
SysStringLen
SysFreeString
SysAllocString
SysAllocStringLen
shlwapi
StrStrIW
UrlUnescapeW
advapi32
SetTokenInformation
RegSetValueExA
OpenProcessToken
RegQueryValueExA
DuplicateTokenEx
GetUserNameA
RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegDeleteKeyA
RegOpenKeyExA
shell32
SHGetFolderPathA
Exports
Exports
Sections
.text Size: 124KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 968B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ