Static task
static1
Behavioral task
behavioral1
Sample
973da405b460495c25c3080eeebbf8f6_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
973da405b460495c25c3080eeebbf8f6_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
973da405b460495c25c3080eeebbf8f6_JaffaCakes118
-
Size
15KB
-
MD5
973da405b460495c25c3080eeebbf8f6
-
SHA1
592b078ff4fef867012e1431612058ed747abb38
-
SHA256
b3c4820bc7f432a7b52fa1440694d78b67e65a0292c0473ff32ae4a95d0e28af
-
SHA512
d12b4e908e92e887da4a2242b8a61ecc25c7447a53067bf525180d88f04441433e863a0edcf71c3926a9f93078c5eb9f21c9e64b337666e53e6663b7c7dfbe50
-
SSDEEP
192:bsPd4zH1M+u60YeUQM7ys821W/D4IltYlzHi9Hy3oSd1tizo90QEb9bZSn:0G0YeUQj2I/6SyF1szo90QEbPS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 973da405b460495c25c3080eeebbf8f6_JaffaCakes118
Files
-
973da405b460495c25c3080eeebbf8f6_JaffaCakes118.dll windows:4 windows x86 arch:x86
1647aab4fb1f0dd992ac55996da37756
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetProcAddress
GetModuleHandleA
DeleteFileA
CreateFileA
WriteFile
OpenEventA
Sleep
GetFileSize
ReadFile
GetModuleFileNameA
VirtualProtectEx
ReadProcessMemory
VirtualFreeEx
GlobalLock
GlobalAlloc
GetCurrentProcess
CreateEventA
SetThreadPriority
CreateThread
CopyFileA
OutputDebugStringA
IsBadReadPtr
GetPrivateProfileStringA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
CreateRemoteThread
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
VirtualFree
GlobalFree
VirtualAlloc
RtlUnwind
user32
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
FindWindowA
GetWindowTextA
wsprintfA
GetMessageA
PostThreadMessageA
GetInputState
advapi32
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
wininet
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 854B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ