Static task
static1
Behavioral task
behavioral1
Sample
8c9367b7dc43dadaa3ec9da767c586cf_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
8c9367b7dc43dadaa3ec9da767c586cf_JaffaCakes118
-
Size
167KB
-
MD5
8c9367b7dc43dadaa3ec9da767c586cf
-
SHA1
5fd0af3aac0c54d4858a50f0e62d6b5a2035d97a
-
SHA256
732b6aa48c1ba35e7c302bb77e14d8b4a7f908209a5d4606c2732ae2611a08ef
-
SHA512
f4fe5da612cc3c90c94bf631fbefae3430a5f7d7ad093795a2f70e22a67076216c49751918bc4b339de1a2f398894218cb56164a0013faf359aba1cf5f521c49
-
SSDEEP
3072:N10UxxXKM7SmRSOEAHnt7oyYv7Z3X6Q3TM+5jldzla5H8HZM6Od+jkDCQ09mJkn9:N10UxxVdXWyYvVHRTM+7d45H8HZ6d+4A
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8c9367b7dc43dadaa3ec9da767c586cf_JaffaCakes118
Files
-
8c9367b7dc43dadaa3ec9da767c586cf_JaffaCakes118.dll windows:4 windows x86 arch:x86
ad6c0ae44664c4d956992135685ee547
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedExchange
GetModuleFileNameA
GetProcAddress
GetVersion
GetStartupInfoA
VirtualAlloc
VirtualProtect
IsBadWritePtr
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
GetACP
GetVersionExA
Sleep
GetCurrentThreadId
GetLastError
GetProcessHeap
QueryPerformanceFrequency
user32
GetCursor
IsWindowUnicode
GetWindowRect
IsCharLowerA
IsCharUpperA
GetWindowRgn
GetWindowDC
WindowFromDC
GetForegroundWindow
CopyIcon
GetDlgItem
GetAncestor
GetWindow
GetLastActivePopup
IsIconic
IsWindowVisible
GetGUIThreadInfo
GetParent
GetDesktopWindow
IsChild
InSendMessage
advapi32
InitializeSecurityDescriptor
IsValidAcl
GetUserNameA
RevertToSelf
msvcrt
malloc
_initterm
free
memmove
_swab
_set_error_mode
rand
_CIsinh
_CIfmod
_CIacos
_itoa
_adjust_fdiv
ldiv
ceil
_pctype
_isctype
ldexp
__mb_cur_max
floor
div
_ltoa
gdi32
GdiFlush
GetROP2
GetBkColor
GetBkMode
GetBitmapDimensionEx
ole32
CoFileTimeNow
CoGetCurrentProcess
shell32
ord524
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 69KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ