Static task
static1
Behavioral task
behavioral1
Sample
ae2fe72f48a8f4b9393c743dc1811511_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ae2fe72f48a8f4b9393c743dc1811511_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ae2fe72f48a8f4b9393c743dc1811511_JaffaCakes118
-
Size
32KB
-
MD5
ae2fe72f48a8f4b9393c743dc1811511
-
SHA1
0d72582201eda4239368210534d86b7ba4ba885f
-
SHA256
3c32b7717aa2187651d613aada35126027deff2fcdcb717ee962bc922c5d9f91
-
SHA512
ab194b1eecd471a69b1a7d1f54891fb31f97c8d540bca66517e5ee51aec4d3038c54cfd84f603c14289d8d31e891f162592a9c9d9b4b7310cf4eb45d2da6a37d
-
SSDEEP
768:z74FOvPD+URG2HHi/a4tIK7ttHmDckQPq16ZwC:z74FOvL+UvHoIDckg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae2fe72f48a8f4b9393c743dc1811511_JaffaCakes118
Files
-
ae2fe72f48a8f4b9393c743dc1811511_JaffaCakes118.dll windows:4 windows x86 arch:x86
b347c73f46b6af812c43a5658b3da09e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetTickCount
ExitProcess
CloseHandle
ReadFile
CreateFileA
WideCharToMultiByte
MultiByteToWideChar
TerminateProcess
ReadProcessMemory
CreateProcessA
GetModuleFileNameA
GetSystemDirectoryA
VirtualProtectEx
GetCurrentThreadId
GetCurrentProcess
WriteFile
DeleteFileA
InitializeCriticalSection
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
LoadLibraryA
SetUnhandledExceptionFilter
SetThreadContext
OpenThread
WriteProcessMemory
CreateMutexA
GetLastError
GetModuleHandleA
GetPrivateProfileStringA
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCommandLineA
IsBadReadPtr
TerminateThread
VirtualProtect
CreateThread
user32
GetWindowThreadProcessId
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetForegroundWindow
GetWindowTextA
FindWindowA
wininet
InternetCloseHandle
InternetReadFile
msvcrt
_initterm
malloc
_strupr
_adjust_fdiv
_stricmp
_strlwr
_strnicmp
free
wcslen
strcmp
??2@YAPAXI@Z
memcpy
strrchr
memset
strlen
strcat
atoi
sprintf
strcpy
rand
srand
??3@YAXPAX@Z
strncpy
strchr
strstr
fclose
fread
fopen
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ