Vout
Static task
static1
Behavioral task
behavioral1
Sample
88411e7fb0082aa9ef64cc572d3ad41b_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
88411e7fb0082aa9ef64cc572d3ad41b_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
88411e7fb0082aa9ef64cc572d3ad41b_JaffaCakes118
-
Size
254KB
-
MD5
88411e7fb0082aa9ef64cc572d3ad41b
-
SHA1
4cfe0fa08a310ba1aec2f72bcaec7434723b47c8
-
SHA256
7ec0b4abf561e660bf9328243e08917168e75894fc9741554e5dbba1d56a4fda
-
SHA512
2be30a2116a4cb2b8832912f85f7adaa7af63bf2b3f6f9ee0b2daa23152ee379247cab8263d59bcfadb38f81d45083df5a92abb34ab7aeab999214a17c2a8884
-
SSDEEP
6144:g+jWmf3eLmezWo2b8pjBQfUikc93LfeUS15:g+jWyumeioM8tBEUikc9zef
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 88411e7fb0082aa9ef64cc572d3ad41b_JaffaCakes118
Files
-
88411e7fb0082aa9ef64cc572d3ad41b_JaffaCakes118.dll windows:4 windows x86 arch:x86
5b1276e9b1d460b702d652363dafcb41
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCommandLineA
GlobalUnlock
OutputDebugStringA
Thread32Next
TerminateThread
Thread32First
CreateToolhelp32Snapshot
GetThreadPriority
GetWindowsDirectoryA
GetCurrentProcessId
GetLocalTime
LoadLibraryA
GetCurrentThreadId
WritePrivateProfileStringA
GetSystemDirectoryA
SetFilePointer
WriteProcessMemory
VirtualAllocEx
DeleteFileA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
OpenProcess
MultiByteToWideChar
GetFullPathNameA
CopyFileA
GetFileSize
FlushFileBuffers
WriteFile
VirtualProtectEx
GetVersionExA
LockResource
TerminateProcess
SizeofResource
FindResourceA
SetThreadPriority
DisableThreadLibraryCalls
VirtualAlloc
VirtualFree
WideCharToMultiByte
Process32Next
Process32First
CreateFileA
ReadFile
ExitProcess
GetPrivateProfileIntA
GetPrivateProfileStringA
GetComputerNameA
GetCurrentProcess
GlobalSize
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CancelIo
InterlockedExchange
SetEvent
ResetEvent
lstrcpyA
lstrlenA
LocalAlloc
SetErrorMode
lstrcmpiA
lstrcatA
GetModuleFileNameA
GetTickCount
RtlUnwind
GetStringTypeW
GetStringTypeA
CreateThread
Sleep
OpenEventA
CreateEventA
CloseHandle
IsBadReadPtr
GlobalAlloc
GlobalLock
GetModuleHandleA
ReadProcessMemory
GetProcAddress
GlobalFree
LoadResource
user32
FindWindowA
GetWindowTextA
wsprintfA
GetClientRect
EnumChildWindows
ToUnicode
GetAsyncKeyState
GetKeyState
MapVirtualKeyA
ToAscii
GetDC
ReleaseDC
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
GetInputState
PostThreadMessageA
GetMessageA
GetWindowThreadProcessId
IsWindowVisible
IsWindowEnabled
GetClassNameA
GetKeyboardState
ExitWindowsEx
BlockInput
keybd_event
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
SetRect
GetSystemMetrics
GetDesktopWindow
GetCursorPos
SendMessageA
GetForegroundWindow
ClientToScreen
wininet
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
gdi32
GetPixel
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteObject
DeleteDC
BitBlt
GetPaletteEntries
CreateHalftonePalette
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegCreateKeyA
OpenProcessToken
RegQueryValueExA
RegDeleteKeyA
msvcrt
??3@YAXPAX@Z
??1type_info@@UAE@XZ
free
calloc
_beginthreadex
__CxxFrameHandler
realloc
??2@YAPAXI@Z
strstr
_CxxThrowException
_ftol
memmove
ceil
ws2_32
connect
htons
gethostbyname
setsockopt
ntohs
WSAStartup
WSACleanup
send
select
closesocket
socket
recv
Exports
Exports
Sections
.text Size: 229KB - Virtual size: 229KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ