Static task
static1
Behavioral task
behavioral1
Sample
60279eb9bcce133fb31a407b57f78c63_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
60279eb9bcce133fb31a407b57f78c63_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
60279eb9bcce133fb31a407b57f78c63_JaffaCakes118
-
Size
19KB
-
MD5
60279eb9bcce133fb31a407b57f78c63
-
SHA1
3493f8bf639511396b38c6ebe1aff0a3cce042bd
-
SHA256
a2d95f3e22a08ef6e770702059be7d7b885d88f4242d238a503bd92f88c78aa1
-
SHA512
f0febecc4fc8e0c47e61b0eae338224d21861e90307290a855b95e215f353d99d2497a53620652ab2a0c91f30335067bbbd642d0771557752089bf11fb2dc592
-
SSDEEP
192:yjcl1VfRHqB03hXwCN4Luj9ot54GPbr2L9Bzuwbmi93T3Qgs4TvD9ESvYl2:4oXTJ9otNHsBik93T3QmDDuSvy2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 60279eb9bcce133fb31a407b57f78c63_JaffaCakes118
Files
-
60279eb9bcce133fb31a407b57f78c63_JaffaCakes118.dll windows:4 windows x86 arch:x86
0dd3a7ab6a54bf4100dd03a62dd59b6c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
WriteProcessMemory
VirtualAllocEx
FindClose
FindNextFileA
lstrcpynA
lstrcpyA
lstrcmpA
FindFirstFileA
VirtualProtectEx
Module32Next
Module32First
ReadFile
GetModuleFileNameA
VirtualFreeEx
CreateRemoteThread
GetPrivateProfileStringA
CreateThread
Sleep
IsBadReadPtr
WinExec
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
OpenProcess
CreateMutexA
GetLastError
ReleaseMutex
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
Process32Next
GetSystemDirectoryA
lstrlenA
WaitForSingleObject
GetModuleHandleA
GetProcAddress
WriteFile
CloseHandle
GetTempPathA
GetTickCount
user32
wsprintfA
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
advapi32
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
shlwapi
StrStrIA
wininet
InternetCloseHandle
netapi32
Netbios
msvcrt
_itoa
strcmp
_purecall
memcpy
??2@YAPAXI@Z
strstr
strncat
strcat
strlen
memset
strcpy
??3@YAXPAX@Z
Sections
.bss Size: - Virtual size: 12KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: 1024B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ