Static task
static1
Behavioral task
behavioral1
Sample
82e710a38eec4fcc78291f943acf4380_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
82e710a38eec4fcc78291f943acf4380_JaffaCakes118.dll
Resource
win10v2004-20240730-en
General
-
Target
82e710a38eec4fcc78291f943acf4380_JaffaCakes118
-
Size
27KB
-
MD5
82e710a38eec4fcc78291f943acf4380
-
SHA1
638887a476f5b0e1bb861c5f5fad9a8e91094d3e
-
SHA256
ffe4a44a15e1999c3adcaf60a8466172debc2107af948c5d3c556a25a854c80b
-
SHA512
581ef0fdf918dabc91d8ffcdeaf6685a02f0d25af17e7028d182d50a272322474aa9689c83a83cbf430be189f7a6883ebdaa9e4d3d7a7d3cbfedabb28d3104e1
-
SSDEEP
768:/Ac9tu13rx3KDwGntqaOWwX7zJnzDMT4KADH5CZostqR:/AQscwytVOzfF3CG6qR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 82e710a38eec4fcc78291f943acf4380_JaffaCakes118
Files
-
82e710a38eec4fcc78291f943acf4380_JaffaCakes118.dll windows:4 windows x86 arch:x86
8fae8cd97763997a6d544b1b8e261d23
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
ReadFile
CreateFileA
GetTempPathA
VirtualAlloc
ExitProcess
GetPrivateProfileStringA
VirtualProtect
WriteFile
TerminateProcess
GetCurrentProcess
SetFilePointer
GetModuleFileNameA
GetTickCount
VirtualProtectEx
WideCharToMultiByte
LoadLibraryA
DeleteFileA
OpenThread
SetUnhandledExceptionFilter
ReadProcessMemory
MultiByteToWideChar
CreateProcessA
GetSystemDirectoryA
GetCurrentThreadId
WriteProcessMemory
GetModuleHandleA
GetProcAddress
GetCurrentProcessId
CreateMutexA
GetLastError
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCommandLineA
IsBadReadPtr
TerminateThread
SetThreadContext
CreateThread
user32
CallNextHookEx
GetClassNameA
GetWindowThreadProcessId
UnhookWindowsHookEx
SetWindowsHookExA
GetWindowTextA
GetForegroundWindow
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
wininet
InternetReadFile
InternetCloseHandle
shlwapi
PathFileExistsA
msvcrt
fopen
atoi
??3@YAXPAX@Z
strncpy
strchr
_strlwr
_strcmpi
_strupr
_stricmp
fread
fclose
strstr
strcmp
srand
??2@YAPAXI@Z
memcpy
strrchr
memset
strcat
sprintf
strcpy
strlen
rand
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ