RunMain
Static task
static1
Behavioral task
behavioral1
Sample
aa09c254a4c388b34745740384e4d3d9_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
aa09c254a4c388b34745740384e4d3d9_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
aa09c254a4c388b34745740384e4d3d9_JaffaCakes118
-
Size
21KB
-
MD5
aa09c254a4c388b34745740384e4d3d9
-
SHA1
145b4b7847e518a64713211aec55d1cad038b090
-
SHA256
17329bab2ec37913a8f1c7539f014f784383be6ca024c10d9969b9125a746f1e
-
SHA512
8c2fdbd4816eb2eba5f042e1448c5c7bd0fc2c3f4d6ca8d7f64db5c978c937585ecbfc2f4fa1d41378b4df358b18ec996bfb4497ace8d872673f9520b807b382
-
SSDEEP
384:yQBT+++36C+C7EJeg5pBuGur80IyPpytqran+o9XOWe1wg:1T+7H+C78DpBuTrmmpGqo+o9Xfe1wg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa09c254a4c388b34745740384e4d3d9_JaffaCakes118
Files
-
aa09c254a4c388b34745740384e4d3d9_JaffaCakes118.dll windows:4 windows x86 arch:x86
b5bee813d5f7c091d8a2d0eee83eaef3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalAlloc
MultiByteToWideChar
WriteFile
CloseHandle
ReadFile
GetFileSize
CreateFileA
FindNextFileA
FindFirstFileA
Process32Next
Sleep
Process32First
CreateToolhelp32Snapshot
GetFullPathNameA
SetCurrentDirectoryA
MoveFileA
GlobalFree
WritePrivateProfileStringA
ExitProcess
WinExec
GetCurrentDirectoryA
ExitThread
OpenMutexA
TerminateProcess
CreateProcessA
GetStartupInfoA
CreatePipe
CreateThread
CreateMutexA
RtlUnwind
GetStringTypeW
GetStringTypeA
GetEnvironmentVariableA
lstrcatA
LoadLibraryA
GetPrivateProfileStringA
GetProcAddress
GetModuleFileNameA
lstrcpyA
lstrcmpA
GetComputerNameA
DeleteFileA
lstrlenA
user32
IsWindowVisible
EnumWindows
GetWindowTextA
gdi32
CreateDCA
GetDeviceCaps
CreateDIBSection
DeleteDC
SaveDC
SelectObject
BitBlt
RestoreDC
DeleteObject
CreateCompatibleDC
ws2_32
WSAStartup
recv
socket
gethostbyname
htons
connect
send
gethostbyaddr
closesocket
inet_addr
wininet
InternetOpenA
InternetConnectA
InternetCloseHandle
FtpGetFileA
FtpPutFileA
gdiplus
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusShutdown
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdiplusStartup
Exports
Exports
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ