Static task
static1
Behavioral task
behavioral1
Sample
5b7699514216342f2bfc901a92d2d7d8_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5b7699514216342f2bfc901a92d2d7d8_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5b7699514216342f2bfc901a92d2d7d8_JaffaCakes118
-
Size
240KB
-
MD5
5b7699514216342f2bfc901a92d2d7d8
-
SHA1
5c98d4b4ea42ad820f3c1f80eec2400575144f88
-
SHA256
c7c918b0586751431d840cb1199d8a72afa19b7976027c7921d78e8857537d13
-
SHA512
0d175051311c72cefcf63c1ee1af7a8d06647ab070a399d33db0856b70b705304a0ef6cb61c7b80fb5baafd74636a0eec8cf6cee00883c804a52cd389db9d870
-
SSDEEP
768:SMiBm0jv+zot9TGpvlxlkUjmwKBBQARQkWPtd:Sgot9CGymwKBBQARY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b7699514216342f2bfc901a92d2d7d8_JaffaCakes118
Files
-
5b7699514216342f2bfc901a92d2d7d8_JaffaCakes118.dll windows:4 windows x86 arch:x86
76398b4eae0ecb826713813e3b107b42
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
gethostname
closesocket
ntdll
strstr
memcpy
memcmp
RtlZeroMemory
RtlUnwind
strlen
kernel32
WriteFile
CloseHandle
CreateThread
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
IsBadReadPtr
LoadLibraryA
Sleep
TerminateThread
WaitForSingleObject
lstrcatA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
OutputDebugStringA
lstrcmpA
CreateFileA
CreateFileMappingA
CreateProcessA
DeleteFileA
GetExitCodeThread
GetFileSize
GetLastError
WideCharToMultiByte
GetSystemDirectoryA
GetTempFileNameA
GetTempPathA
MapViewOfFile
MoveFileExA
ReadFile
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtectEx
GetStartupInfoA
user32
UnhookWindowsHookEx
wsprintfA
CallNextHookEx
FindWindowA
GetWindowThreadProcessId
KillTimer
RegisterWindowMessageA
SendMessageA
SetTimer
SetWindowsHookExA
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
OpenProcessToken
ole32
StringFromGUID2
Sections
.text Size: 224KB - Virtual size: 221KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 8B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ