Static task
static1
Behavioral task
behavioral1
Sample
5b65dff1a756b6f191a451fe2a56f03b_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5b65dff1a756b6f191a451fe2a56f03b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5b65dff1a756b6f191a451fe2a56f03b_JaffaCakes118
-
Size
40KB
-
MD5
5b65dff1a756b6f191a451fe2a56f03b
-
SHA1
b11b8e7057e69cfb69fe27f857ed8364bb9c3a1b
-
SHA256
63f896300dfadb2740286f5bc9076438270307ea0ced765f0aa6d2fa60c81cb9
-
SHA512
8d8a16f5f8c5d9907bb4d5ef0fd9f22f9e9e6e2f70e2c5093e3f3e2936cee168249c74862fbe5ab9f08a7f169906e9d69d7b56205194f99f10deae5b3b00b71d
-
SSDEEP
768:V6Ng80f7bsJSEiguOQcBBQARQkXpHA/Z8:8NVaS6OQcBBQARJmZ8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b65dff1a756b6f191a451fe2a56f03b_JaffaCakes118
Files
-
5b65dff1a756b6f191a451fe2a56f03b_JaffaCakes118.dll windows:4 windows x86 arch:x86
4707ff06cb9a1a092d1c57b016ea8de8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
sscanf
RtlNumberGenericTableElements
RtlInsertElementGenericTable
RtlInitializeGenericTable
RtlGetElementGenericTable
RtlDeleteElementGenericTable
RtlZeroMemory
RtlUnwind
_snprintf
memcmp
memcpy
strlen
strstr
ws2_32
gethostname
closesocket
kernel32
IsBadReadPtr
lstrcpynA
WriteFile
VirtualProtectEx
VirtualFree
GlobalAlloc
GlobalFree
CloseHandle
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TerminateThread
WaitForSingleObject
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrlenA
GetPrivateProfileStringA
WideCharToMultiByte
CreateFileA
GetFileSize
ReadFile
CreateFileMappingA
CreateProcessA
VirtualAlloc
GetExitCodeThread
GetLastError
GetStartupInfoA
GetSystemDirectoryA
GetTempFileNameA
GetTempPathA
MapViewOfFile
MoveFileExA
UnmapViewOfFile
DeleteFileA
user32
UnhookWindowsHookEx
SetWindowsHookExA
SetTimer
SendMessageA
RegisterWindowMessageA
wsprintfA
CallNextHookEx
FindWindowA
GetWindowThreadProcessId
KillTimer
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 8B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 916B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ