ChenGuanXi
Static task
static1
Behavioral task
behavioral1
Sample
5bf56fb396aa563aa7d315a42ee0f3e2_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5bf56fb396aa563aa7d315a42ee0f3e2_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5bf56fb396aa563aa7d315a42ee0f3e2_JaffaCakes118
-
Size
26KB
-
MD5
5bf56fb396aa563aa7d315a42ee0f3e2
-
SHA1
c3555b8f8ff7c6f7d8e86a2e44b283ea8b180d32
-
SHA256
e2ec477f2197e8aad90c33e47eeb1fe46f51a470476dd386ee42c1202e79f128
-
SHA512
7d92c550667571088ef2025f4aba85c19e4244354d20ddc2506a50b02c759fb99161ccca2b8dbc23ea17f7d6e3ae894cc6b4038b0407ddfe7d866ee6f9ae4044
-
SSDEEP
384:EqbJERYU8x8dk+Cq0JU+M1ssP4hBVbGVVHGtdv5tMajoby+XkGw47DUT+9w:EAJERF86dk+Cq6ULWsifjob9XkGNsGw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5bf56fb396aa563aa7d315a42ee0f3e2_JaffaCakes118
Files
-
5bf56fb396aa563aa7d315a42ee0f3e2_JaffaCakes118.dll windows:4 windows x86 arch:x86
5d3ff3d9aa4125449d79d38d2f6a4ed4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetSystemDirectoryA
CloseHandle
GlobalFree
GlobalUnlock
WriteFile
CreateFileA
GlobalLock
GlobalAlloc
GetModuleFileNameA
Thread32Next
TerminateThread
Thread32First
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
ReadProcessMemory
GetModuleHandleA
CreateProcessA
ReadFile
GetFileSize
CreateThread
ExitThread
WriteProcessMemory
GetProcAddress
LoadLibraryA
OutputDebugStringA
DeleteFileA
user32
IsRectEmpty
CallNextHookEx
SetWindowsHookExA
TranslateMessage
DispatchMessageA
GetMessageA
ReleaseDC
GetDC
gdi32
DeleteDC
SelectObject
CreateCompatibleBitmap
CreateDCA
CreateCompatibleDC
GetDeviceCaps
GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetObjectA
BitBlt
ws2_32
WSAStartup
htons
inet_addr
gethostbyname
connect
WSAGetLastError
send
closesocket
WSACleanup
socket
wininet
HttpSendRequestW
HttpSendRequestA
msvcrt
fclose
fread
fopen
sprintf
_except_handler3
fwrite
free
malloc
Exports
Exports
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 512B - Virtual size: 392B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ