Static task
static1
Behavioral task
behavioral1
Sample
790cde6e7ab353702d29312d40051945_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
790cde6e7ab353702d29312d40051945_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
790cde6e7ab353702d29312d40051945_JaffaCakes118
-
Size
22KB
-
MD5
790cde6e7ab353702d29312d40051945
-
SHA1
cb54c1ea2825722b0ef86d487d37a329f8a6ec69
-
SHA256
2ebea4e2dce7aca0a3098807967fe432834ae6f2a14e14422847b44792e1ed4a
-
SHA512
4eb4ee2a23465eb1435aa353196583136a8bd3d731dc818d2075e59dd40e5d7bda5efe505d1bf47e55d039981374d3b7caa0ab45d2c66b4805d01a70056fcaec
-
SSDEEP
384:SkKxaKloQa9VQqOgnNENujN7r2V1cwocxD6ub24F/jTxv3OiaFE4F:rK+h9VQKNEwjN/2V1N9xDH9TxvEE4F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 790cde6e7ab353702d29312d40051945_JaffaCakes118
Files
-
790cde6e7ab353702d29312d40051945_JaffaCakes118.dll windows:4 windows x86 arch:x86
b35a38641e973026c2488cee142172db
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
CreateMutexA
GetCurrentProcessId
GetModuleFileNameA
VirtualProtectEx
GetCurrentThreadId
GetCurrentProcess
SetThreadContext
GetCurrentThread
SetUnhandledExceptionFilter
GetComputerNameA
GetFileSize
RaiseException
InitializeCriticalSection
GetPrivateProfileStringA
WideCharToMultiByte
LeaveCriticalSection
GetModuleHandleA
GetProcAddress
LoadLibraryA
OpenThread
ReadProcessMemory
WriteProcessMemory
CreateFileA
ReadFile
CloseHandle
ExitProcess
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCommandLineA
IsBadReadPtr
TerminateThread
EnterCriticalSection
CreateThread
user32
GetForegroundWindow
GetDesktopWindow
GetWindow
GetWindowThreadProcessId
GetClassNameA
GetWindowTextA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
FindWindowA
msvcrt
free
_strnicmp
_initterm
malloc
_adjust_fdiv
_strlwr
_stricmp
??2@YAPAXI@Z
memcpy
strrchr
memset
sprintf
strcpy
strlen
strcat
strncpy
strchr
strstr
strcmp
wcslen
fclose
fread
fopen
wininet
InternetOpenA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 153B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ