Static task
static1
Behavioral task
behavioral1
Sample
866edc7a1a1b8357051a4d0f2ae9c6e9_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
866edc7a1a1b8357051a4d0f2ae9c6e9_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
866edc7a1a1b8357051a4d0f2ae9c6e9_JaffaCakes118
-
Size
18KB
-
MD5
866edc7a1a1b8357051a4d0f2ae9c6e9
-
SHA1
939d3d7a339b0ca183e18985e00a8704cdfdea3d
-
SHA256
40b467bb488a255e5c7b0ebb74acde2b9446c7dd984d2162258cf92ad841a4b4
-
SHA512
52c25f655b6ba7e7f04dfaa29505ba2608965f1f964647fd44a63be8ba05416cc607716aa963906136ca2bf7cfaa284b234de1eaef3780c4686f2a442425468e
-
SSDEEP
384:DmJuolS3Jlof6Gg7NwhogTVxhKDJKQBW/3o6Lys+GKkY:QirBGg7NWTPNgzGKk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 866edc7a1a1b8357051a4d0f2ae9c6e9_JaffaCakes118
Files
-
866edc7a1a1b8357051a4d0f2ae9c6e9_JaffaCakes118.dll windows:4 windows x86 arch:x86
5f6c92b6c2acd78cd3bdffbcd91cb232
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
TlsAlloc
HeapCreate
CreateThread
TlsGetValue
HeapAlloc
GetLastError
SetLastError
TlsSetValue
lstrcmpiA
GlobalFindAtomA
GlobalAddAtomA
WideCharToMultiByte
MultiByteToWideChar
IsBadWritePtr
GetModuleHandleA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CloseHandle
GetVersionExA
LoadLibraryA
GetProcAddress
GetACP
GetOEMCP
GetCPInfo
CreateFileA
CompareStringA
CreateProcessA
CreateProcessW
GetTimeZoneInformation
GetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetSystemDefaultLCID
GetUserDefaultLCID
GetSystemDefaultLangID
GetUserDefaultLangID
GetCommandLineA
GetCommandLineW
IsDBCSLeadByte
OpenEventA
SetEvent
IsDBCSLeadByteEx
SetUnhandledExceptionFilter
TerminateProcess
ExitProcess
HeapFree
GetModuleHandleW
GetSystemDirectoryW
lstrcatW
LoadLibraryW
VirtualProtect
FlushInstructionCache
CreateFileW
GetSystemDirectoryA
lstrlenA
lstrcatA
lstrlenW
ReadFile
CreateEventA
ReadProcessMemory
WriteProcessMemory
ResumeThread
Sleep
SuspendThread
GetThreadContext
VirtualAllocEx
CreateRemoteThread
WaitForMultipleObjects
GetCurrentThreadId
user32
GetClassInfoA
GetClassInfoW
IsWindowUnicode
GetClassNameA
CallNextHookEx
GetPropA
SetPropA
GetWindowLongA
SetWindowLongW
CallWindowProcA
GetWindowLongW
RemovePropA
CallWindowProcW
SendMessageW
PostMessageW
SendNotifyMessageW
SendMessageCallbackW
SendMessageTimeoutW
DialogBoxIndirectParamW
CreateDialogIndirectParamW
CreateDialogParamW
DialogBoxParamW
DefWindowProcA
DefMDIChildProcA
DefDlgProcA
DefFrameProcA
DialogBoxParamA
DialogBoxIndirectParamA
CreateDialogIndirectParamA
CreateDialogParamA
CreateWindowExA
SetWindowTextA
GetWindowTextA
SendMessageA
SendMessageCallbackA
SendMessageTimeoutA
SendNotifyMessageA
PostMessageA
SetWindowLongA
GetMenuStringA
CharPrevA
CharNextA
CharPrevExA
CharNextExA
GetMenuStringW
GetMenuItemInfoW
SetMenuItemInfoW
GetWindowTextW
wsprintfA
GetForegroundWindow
MessageBoxA
SetWindowTextW
CreateWindowExW
DefWindowProcW
DefMDIChildProcW
DefDlgProcW
DefFrameProcW
SetWindowsHookExA
SetWindowsHookExW
UnhookWindowsHookEx
version
VerQueryValueA
gdi32
EnumFontFamiliesExA
CreateFontIndirectA
CreateFontIndirectW
ntdll
RtlMultiByteToUnicodeSize
RtlUnicodeToMultiByteSize
RtlOemToUnicodeN
RtlUnicodeToOemN
Sections
ntleat Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ntlead Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ