Static task
static1
Behavioral task
behavioral1
Sample
5a47db85bda2f569f058a9136c08dd78_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5a47db85bda2f569f058a9136c08dd78_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5a47db85bda2f569f058a9136c08dd78_JaffaCakes118
-
Size
27KB
-
MD5
5a47db85bda2f569f058a9136c08dd78
-
SHA1
974849cc511a0f0d6e9805073c768ce44035cc2f
-
SHA256
00c486b9dd2fe2e154e9a8248aa5c9dd3b169b5312a764dde69ceb73da332f81
-
SHA512
a0a9bde852c9327243c0fda2564029d3a196412a3d04b1d16b71aabbc582d06fc1942ef917ca0940cc4cf70f4ef42596103153dab55e4e17bac820e7d1ac740d
-
SSDEEP
384:YX1Z0MpYF6jxmCDgMjZqsOGrUmvS7wWIf4A0lkPGkoO320lp/PRnQEveIUDPB:mZNjx14hmvS0WD5lkDlRRnQEvCDPB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a47db85bda2f569f058a9136c08dd78_JaffaCakes118
Files
-
5a47db85bda2f569f058a9136c08dd78_JaffaCakes118.dll windows:4 windows x86 arch:x86
dbecf5c90e9fb863cd55425d58bd24c7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
GetModuleHandleA
CloseHandle
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
WriteFile
DeleteFileA
InitializeCriticalSection
VirtualProtectEx
GetPrivateProfileStringA
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
LoadLibraryA
MultiByteToWideChar
GetTickCount
ReadProcessMemory
CreateProcessA
VirtualAlloc
GetSystemDirectoryA
GetCurrentThreadId
GetCurrentProcess
WriteProcessMemory
GetCurrentProcessId
CreateMutexA
GetLastError
ExitProcess
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCommandLineA
IsBadReadPtr
TerminateThread
TerminateProcess
CreateThread
user32
GetForegroundWindow
GetWindowThreadProcessId
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetWindowTextA
FindWindowA
wininet
InternetCloseHandle
InternetReadFile
msvcrt
strchr
fclose
fread
fopen
_strcmpi
_stricmp
_strupr
_strlwr
strncpy
??3@YAXPAX@Z
atoi
strstr
??2@YAPAXI@Z
memcpy
strrchr
memset
strcat
sprintf
strcpy
strlen
rand
srand
strcmp
wcslen
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ