Static task
static1
Behavioral task
behavioral1
Sample
68eedff70495f29695c339305bcc70a5_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
68eedff70495f29695c339305bcc70a5_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
68eedff70495f29695c339305bcc70a5_JaffaCakes118
-
Size
23KB
-
MD5
68eedff70495f29695c339305bcc70a5
-
SHA1
8d7a828bd5c84fedaed4a06e12d5a2fd47941b47
-
SHA256
4c12497a627751944b1987e5c7e2a5d66f7aa2bcd386659e5606cda529e97c9f
-
SHA512
f4d36f72c1b2302719e29e8b30cc0d2c87bfd9918e9948ef6017d1498eb70d5b615d932e8b27602980cef414a51cd1e9bec110ed68bfe7f7d07f0d1b471be44e
-
SSDEEP
384:g7DuksLfj59lcjFZJvmoQZjPrDI1rRdMaIugA5xfwZcS28Gq232apyzZnBv2Zl7h:o1inlcjt/GPrDI1NdUJAcZY8AGZnl2rC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 68eedff70495f29695c339305bcc70a5_JaffaCakes118
Files
-
68eedff70495f29695c339305bcc70a5_JaffaCakes118.dll windows:4 windows x86 arch:x86
317c15bde6ea4152574c25e5b3810277
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtectEx
GetPrivateProfileStringA
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
LoadLibraryA
ReadProcessMemory
GetModuleHandleA
ResumeThread
SetThreadContext
SuspendThread
OpenThread
SetUnhandledExceptionFilter
GetCurrentThread
InitializeCriticalSection
Process32First
CreateToolhelp32Snapshot
GetModuleFileNameA
GetCurrentThreadId
GetCurrentProcess
WriteProcessMemory
IsBadReadPtr
CloseHandle
TerminateThread
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
CreateThread
GetCurrentProcessId
OpenMutexA
CreateMutexA
Sleep
Process32Next
RaiseException
user32
GetWindowTextA
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetForegroundWindow
FindWindowA
GetWindowThreadProcessId
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
msvcrt
_strlwr
free
_initterm
malloc
_adjust_fdiv
_stricmp
strrchr
wcslen
memset
fopen
strcat
sprintf
strcpy
memcpy
strncpy
strchr
??2@YAPAXI@Z
strlen
sscanf
strstr
??3@YAXPAX@Z
fclose
fread
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ