RQOWT
Static task
static1
Behavioral task
behavioral1
Sample
8b93d4319545d23fc7e74691824db024_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8b93d4319545d23fc7e74691824db024_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8b93d4319545d23fc7e74691824db024_JaffaCakes118
-
Size
580KB
-
MD5
8b93d4319545d23fc7e74691824db024
-
SHA1
e3181c24a2f9d0ad558538fd303e0f62649f1c98
-
SHA256
e83200ba11a7438a636abd45604a1703f1d9ab5abbfe75d853a21ff3efac9055
-
SHA512
fd7a2f597874fc990c7fc17fc37dfbf2cf56240a505a5336eb240ba89c17c72506ec85a0b0b4db3070166c4dfb9a1fd0ef8d92c0fb6fadf405d2c89423ad41f8
-
SSDEEP
12288:+e6EZ/G9KSmE6b4EzkShgYWcMWerm4jaxb/U:+e6inE6Lh3WXlqxbM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8b93d4319545d23fc7e74691824db024_JaffaCakes118
Files
-
8b93d4319545d23fc7e74691824db024_JaffaCakes118.dll windows:4 windows x86 arch:x86
bf84eb251ba579a9cdb495565b3a51bf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalLock
GlobalAlloc
SetFilePointer
CreateFileA
LeaveCriticalSection
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
lstrcpyA
CreateFileMappingA
FreeLibrary
GetModuleHandleA
DisableThreadLibraryCalls
GetCurrentProcessId
VirtualAlloc
WriteProcessMemory
GetModuleFileNameA
CloseHandle
VirtualProtect
user32
GetWindow
GetWindowThreadProcessId
IsWindowVisible
IsWindow
GetTopWindow
CallNextHookEx
GetKeyState
RegisterClassExA
GetClassNameA
GetClassInfoExA
SetParent
MapWindowPoints
SetWindowPos
OpenClipboard
ShowWindow
CloseClipboard
SendDlgItemMessageA
wsprintfA
GetDlgItemTextA
SetDlgItemTextA
IsDlgButtonChecked
CheckDlgButton
EnableWindow
SetWindowTextA
DestroyWindow
PostQuitMessage
GetWindowTextA
KillTimer
GetDlgItem
SendMessageA
SetClipboardData
GetWindowRect
EmptyClipboard
advapi32
RegSetValueExA
RegOpenKeyA
RegCloseKey
comctl32
ord17
msvcrt
free
strstr
atoi
_beginthread
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
malloc
_adjust_fdiv
_itoa
_initterm
shlwapi
PathFindFileNameA
Exports
Exports
Sections
.RQOWTQ Size: 196KB - Virtual size: 194KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text0 Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 268KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ