Static task
static1
Behavioral task
behavioral1
Sample
5eea058c88149b3d00ac23d50f796d7b_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5eea058c88149b3d00ac23d50f796d7b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5eea058c88149b3d00ac23d50f796d7b_JaffaCakes118
-
Size
160KB
-
MD5
5eea058c88149b3d00ac23d50f796d7b
-
SHA1
591571d733144a7bed8a3c33eb9f1a335d128af3
-
SHA256
ffc6f65b98d18efe78f1058fc158eb7ee39d2375e7803a32e9319e78cf837fcf
-
SHA512
25589d28a6e264fbb41aa259f1a1ce7171a12950ddfeeadb1e28bbbeefbd65f1ef19c4bc46476f568eac57b2c6ade27f1826cea4b4b7d7daea70c93a14622843
-
SSDEEP
3072:wcOBWgf4lZf+qvA8oalKpyyZtq12LCJafFAMLcdtBpuNbsEVz:wcOBWgf4lwqvxlKIvaLOMIHBi7Vz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5eea058c88149b3d00ac23d50f796d7b_JaffaCakes118
Files
-
5eea058c88149b3d00ac23d50f796d7b_JaffaCakes118.dll windows:4 windows x86 arch:x86
21bbf8ed4239f72095cad5c97bb20f30
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcess
GetComputerNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
Sleep
SetThreadContext
GetThreadContext
GetCurrentThread
SetUnhandledExceptionFilter
ExitProcess
CloseHandle
ReadFile
CreateFileA
GetCommandLineA
GlobalUnlock
OutputDebugStringA
CreateEventA
OpenEventA
GetProcAddress
LoadLibraryA
TerminateThread
SetFilePointer
GetCurrentProcessId
TerminateProcess
CreateThread
GetCurrentThreadId
CreateRemoteThread
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
DeleteFileA
WriteFile
GetFileSize
VirtualProtectEx
SetThreadPriority
VirtualAlloc
VirtualFree
WideCharToMultiByte
MultiByteToWideChar
Process32Next
Process32First
CreateToolhelp32Snapshot
Thread32Next
Thread32First
GetThreadPriority
GetWindowsDirectoryA
GetStringTypeW
GetStringTypeA
IsBadReadPtr
GlobalAlloc
GlobalLock
GetModuleHandleA
ReadProcessMemory
GlobalFree
OpenProcess
GetModuleFileNameA
RtlUnwind
user32
EnumChildWindows
GetClassNameA
IsWindowVisible
ReleaseDC
GetDC
ClientToScreen
GetClientRect
ToAscii
MapVirtualKeyA
GetKeyboardState
GetKeyState
GetForegroundWindow
IsWindowEnabled
GetAsyncKeyState
ToUnicode
wsprintfA
GetWindowTextA
FindWindowA
GetWindowThreadProcessId
GetMessageA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
GetInputState
PostThreadMessageA
SendMessageA
wininet
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
InternetReadFile
gdi32
GetPixel
advapi32
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
Sections
.text Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ