Static task
static1
Behavioral task
behavioral1
Sample
ae1d371d70a66834ed5f5a98ce3b372b_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ae1d371d70a66834ed5f5a98ce3b372b_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ae1d371d70a66834ed5f5a98ce3b372b_JaffaCakes118
-
Size
22KB
-
MD5
ae1d371d70a66834ed5f5a98ce3b372b
-
SHA1
3d03231a90608ebba83942d5435c50d5055168d0
-
SHA256
0aa2bc04f47f165fe00180c166aee4501bacb21d01f4d0db0ee9b59f134986e0
-
SHA512
c9b5d6d4e3a1acd31765871f1d2dd193098e366b2d233ebcc8e119e6d2693373a702d385c552a1282c6eff96ad01a8b4ef5a0dcf6fcbc1fd1f6213720b0c31d4
-
SSDEEP
384:LDDxGqoilIKB7hNv3n+1dLrCIfWmyfo5zNO72cXXx/MZS+4hS:LXKilIKB7hV3CdLrbfhHz2XXdq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae1d371d70a66834ed5f5a98ce3b372b_JaffaCakes118
Files
-
ae1d371d70a66834ed5f5a98ce3b372b_JaffaCakes118.dll windows:4 windows x86 arch:x86
544c1e6d4b7b37cffc0c0ff7e9657867
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateToolhelp32Snapshot
GetModuleFileNameA
VirtualProtectEx
GetCurrentProcess
GlobalFree
GlobalUnlock
IsBadReadPtr
RaiseException
InitializeCriticalSection
GetPrivateProfileStringA
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
Process32First
SetThreadContext
SetUnhandledExceptionFilter
WriteProcessMemory
Process32Next
CloseHandle
TerminateThread
Sleep
CreateThread
GlobalAlloc
GlobalLock
LoadLibraryA
GetProcAddress
GetCurrentThread
GetCurrentProcessId
CreateMutexA
OpenMutexA
ReadProcessMemory
user32
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetWindowThreadProcessId
FindWindowA
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
msvcrt
sscanf
_stricmp
_adjust_fdiv
malloc
_initterm
free
wcslen
memset
fopen
memcpy
strcat
sprintf
strcpy
??2@YAPAXI@Z
strrchr
strstr
strlen
??3@YAXPAX@Z
_strlwr
strncpy
fclose
fread
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ