Static task
static1
Behavioral task
behavioral1
Sample
6fbad56878c0410241fe9e6c2f0f5bcc_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6fbad56878c0410241fe9e6c2f0f5bcc_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6fbad56878c0410241fe9e6c2f0f5bcc_JaffaCakes118
-
Size
7KB
-
MD5
6fbad56878c0410241fe9e6c2f0f5bcc
-
SHA1
de2c44483c5ee43284f6b0def6bd491fa61fb05d
-
SHA256
48f28e5734c8de56bcbe05c3c1d5d8e901e6b35c42d43c1c8cfdf2e7d37d30be
-
SHA512
bbd7899d42df11fb49af5b781ddaa03f4dde993f69bddd070aecd0b8567671ea8b0a0081f61fb68a72e95da6b0f419c4350ebc2932467c3b214e8de53f091d0a
-
SSDEEP
96:rcuV5HkiLpubFRtc0CIAh49c9/GNZsub7u4GPPq5F:rcGEiLgbFRu0LAh49cmGubq4GPPq/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6fbad56878c0410241fe9e6c2f0f5bcc_JaffaCakes118
Files
-
6fbad56878c0410241fe9e6c2f0f5bcc_JaffaCakes118.dll windows:4 windows x86 arch:x86
60aea9b8018cf3898b9e8ab7694d957d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord537
ord2818
ord941
ord389
ord5207
ord5356
ord825
ord540
ord2915
ord800
ord1988
ord690
ord823
msvcrt
tolower
strcmp
__CxxFrameHandler
strtol
memset
time
clock
srand
rand
malloc
free
atol
strcat
strcpy
strlen
sprintf
kernel32
LoadResource
LockResource
CreateFileA
CreateThread
SizeofResource
GetSystemDirectoryA
LoadLibraryA
DeleteFileA
Sleep
FreeLibraryAndExitThread
FindResourceA
ReadFile
CloseHandle
WriteFile
GetCurrentProcess
OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
CreateProcessA
CreateToolhelp32Snapshot
Process32First
Process32Next
lstrlenA
GetPrivateProfileIntA
GetPrivateProfileStringA
SetFilePointer
user32
GetWindowThreadProcessId
FindWindowA
advapi32
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
shell32
SHGetFolderPathA
wininet
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
iphlpapi
GetAdaptersInfo
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 490B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ