Static task
static1
Behavioral task
behavioral1
Sample
5b941dfbf01e63fef759c7ba8e6371e8_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5b941dfbf01e63fef759c7ba8e6371e8_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5b941dfbf01e63fef759c7ba8e6371e8_JaffaCakes118
-
Size
157KB
-
MD5
5b941dfbf01e63fef759c7ba8e6371e8
-
SHA1
fa59de534f139a30f754cc75552f72d0c0375e07
-
SHA256
48b5d7396c91430c49f45c52d4364c305ebc52e544185bbfb8eb83d54b233756
-
SHA512
cbae9bfc75aaca9b514e9f81a92e52b227da938e173c54493c48a86ffb725e3dcd3a56df7d2b158a731c90c258a30a5599266aa70fc1cf8e63cab2d09b2f9c53
-
SSDEEP
3072:aQ5usDNQEZzBa2Nyo2T3YvEZqvwfIlYZkrLTKnb4QPsf0Ojf+qj9tn:ptTz6jocZgTBLqPkfj3j9tn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b941dfbf01e63fef759c7ba8e6371e8_JaffaCakes118
Files
-
5b941dfbf01e63fef759c7ba8e6371e8_JaffaCakes118.dll windows:4 windows x86 arch:x86
ffbc1b2b0a80d2ad50288a3708fd4400
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersionExA
LoadLibraryA
InterlockedExchange
GetProcAddress
GetVersion
GetStartupInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
VirtualAlloc
VirtualProtect
VirtualQuery
IsBadReadPtr
Sleep
QueryPerformanceFrequency
GetComputerNameA
IsBadWritePtr
GetProcessHeap
user32
GetMenuContextHelpId
GetWindowTextLengthA
IsCharLowerA
IsCharAlphaNumericA
GetWindowDC
IsClipboardFormatAvailable
GetDC
GetForegroundWindow
CopyIcon
GetAncestor
GetWindow
GetWindowInfo
GetGUIThreadInfo
GetParent
GetDesktopWindow
IsChild
IsMenu
SetLastErrorEx
BlockInput
InSendMessage
IsWindowUnicode
advapi32
IsValidSid
msvcrt
_adjust_fdiv
malloc
_initterm
free
_memicmp
_swab
srand
_set_error_mode
rand
_itoa
_CIasin
_CIpow
_isctype
__doserrno
__mb_cur_max
time
localeconv
frexp
modf
floor
ldexp
_pctype
_errno
gdi32
GetBkColor
GetBkMode
GetBitmapDimensionEx
ole32
CoDosDateTimeToFileTime
CoGetCurrentProcess
shell32
ord66
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ