Static task
static1
Behavioral task
behavioral1
Sample
5b500fbff8d74a859c446ab909d3c255_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5b500fbff8d74a859c446ab909d3c255_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5b500fbff8d74a859c446ab909d3c255_JaffaCakes118
-
Size
19KB
-
MD5
5b500fbff8d74a859c446ab909d3c255
-
SHA1
142352d90ba02dc89688aec722d23a6e69c57650
-
SHA256
fbb53aa3be9113330d409699106800bc56e73c91d0b8f22b45006dfed5affa4e
-
SHA512
bdda9b693d2a65b0c6e8de84ff47ed92e18a1a016d843c9c0b09f6526f22a4102c639fad72bedb5b2801bed166967b084a1b9be2706cf36079185a6f588664f9
-
SSDEEP
384:kju14v3tWcVshfi24gCdnafHpJ23cDeyD2Ivq+cisOgE61HeamA:kj1TVsSgKOzacDfSQsOgE6team
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b500fbff8d74a859c446ab909d3c255_JaffaCakes118
Files
-
5b500fbff8d74a859c446ab909d3c255_JaffaCakes118.dll windows:4 windows x86 arch:x86
cf9204511e398c483fbab986b0160a64
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalUnlock
GlobalLock
GlobalAlloc
Thread32Next
GetThreadPriority
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetPrivateProfileStringA
IsBadReadPtr
ExitProcess
RaiseException
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
GlobalFree
GetModuleHandleA
ReadProcessMemory
SetThreadContext
SetUnhandledExceptionFilter
WriteProcessMemory
Sleep
SetThreadPriority
WaitForSingleObject
CloseHandle
GetCurrentProcess
GetCurrentThreadId
VirtualProtectEx
GetModuleFileNameA
CreateThread
TerminateThread
GetCurrentProcessId
CreateMutexA
LoadLibraryA
GetLastError
user32
GetWindowThreadProcessId
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetForegroundWindow
GetWindowTextA
FindWindowA
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
msvcrt
free
_initterm
_stricmp
malloc
_adjust_fdiv
_strlwr
fopen
fread
fclose
strstr
strcat
sprintf
strcpy
memcpy
strrchr
memset
strlen
??2@YAPAXI@Z
strcmp
wcslen
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 153B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ