Static task
static1
Behavioral task
behavioral1
Sample
89666085b4f73ef76048840006aaa438_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
89666085b4f73ef76048840006aaa438_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
89666085b4f73ef76048840006aaa438_JaffaCakes118
-
Size
28KB
-
MD5
89666085b4f73ef76048840006aaa438
-
SHA1
ebcce06f9a8584bf2f49c86cfcd115945e5da151
-
SHA256
b74ec7768accc3530846254418ae4a4c7251369086ce70d176ced39104f0c717
-
SHA512
0ccda3c0cca8343ca15ef18bee5a26bdfa9049dc1f5337b6baf58431f524ef0abec3881702b82039815fe19f852fb5a371785967f51d5e4f05af1b673b036c64
-
SSDEEP
384:UIWOeAe7KOu/kk//EDNjwB49gR6TCITRVfpct58fJJ:UIWOeMkkng6B4S/ITRVfat58fJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 89666085b4f73ef76048840006aaa438_JaffaCakes118
Files
-
89666085b4f73ef76048840006aaa438_JaffaCakes118.dll windows:4 windows x86 arch:x86
1eb8babf8f685164ff7a185bb8899e7d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
ntohs
closesocket
msvcrt
free
_initterm
malloc
atoi
_itoa
memcpy
strcmp
strstr
strrchr
fseek
ftell
??2@YAPAXI@Z
strchr
strncpy
??3@YAXPAX@Z
fopen
fread
fclose
fwrite
time
memset
_strupr
_strlwr
_adjust_fdiv
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
CopyFileA
GetProcAddress
GetTempPathA
CreateThread
SetEvent
WaitForSingleObject
lstrlenA
lstrcpyA
ReadProcessMemory
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
GetModuleFileNameA
lstrcatA
CreateEventA
Sections
.text Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ