PcSharePlayWork
Static task
static1
Behavioral task
behavioral1
Sample
89e89083f3f865fee3105e51c7456d54_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
89e89083f3f865fee3105e51c7456d54_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
89e89083f3f865fee3105e51c7456d54_JaffaCakes118
-
Size
24KB
-
MD5
89e89083f3f865fee3105e51c7456d54
-
SHA1
b76607a925b766d4a205b61405e8d8e2bf05e22b
-
SHA256
b96b3e1ce29b40d55e863260e1b209edc6dee59dc9e03910a645addef4e4c058
-
SHA512
897ce739bf5436d0711864511ecff13b26409b73318d7a70d7604cf1cd0bb87c2ab37ff6cbd6e827a805aefe58972a1986c3b5dd8a15a648557384a13ca9039b
-
SSDEEP
192:0uqZMP8rBevSQfZ9JtjaTqIzQJm78QJm7H:E884KaRjUBQJm78QJm7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 89e89083f3f865fee3105e51c7456d54_JaffaCakes118
Files
-
89e89083f3f865fee3105e51c7456d54_JaffaCakes118.dll windows:4 windows x86 arch:x86
90e0d777dce0b0d350225f266fd683d6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FreeLibrary
Sleep
CreateEventA
WaitForSingleObject
CloseHandle
GetCurrentProcessId
OpenEventA
GlobalMemoryStatus
GetComputerNameA
GetSystemInfo
GetVersionExA
GetVersion
SetEvent
GetProcAddress
GetVolumeInformationA
LoadLibraryA
GetWindowsDirectoryA
user32
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
advapi32
GetUserNameA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
wininet
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
msvcrt
strcat
memcpy
fopen
_adjust_fdiv
_initterm
_onexit
__dllonexit
fclose
fwrite
malloc
??3@YAXPAX@Z
_beginthreadex
memset
??2@YAPAXI@Z
sprintf
free
Exports
Exports
Sections
.text Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 868B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 4KB - Virtual size: 592B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ