Install
Static task
static1
Behavioral task
behavioral1
Sample
b01c6cd7bc5577ff5e4860393dd3034e_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b01c6cd7bc5577ff5e4860393dd3034e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b01c6cd7bc5577ff5e4860393dd3034e_JaffaCakes118
-
Size
32KB
-
MD5
b01c6cd7bc5577ff5e4860393dd3034e
-
SHA1
a2525d00f89311678ded2b46852e1e6df0114070
-
SHA256
a804897780ca31985803c5aadc81160aacbd83c4231e99cd41324678f448e4fd
-
SHA512
1dd6fa6a72b1fa99661f3b0be7e69814d8a46ccc12b4cd764769434ff9af5476b8e75f73b172153d2bfe14d39e53d79bcf5ec44e8ffc489769467efb37e3285d
-
SSDEEP
384:YKL103Nal8nMGAnRZKelgE0q6dKU2/lEWkq4fTOdtCj:YKG3LMGATeEd6sl/kDTGt0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b01c6cd7bc5577ff5e4860393dd3034e_JaffaCakes118
Files
-
b01c6cd7bc5577ff5e4860393dd3034e_JaffaCakes118.dll windows:4 windows x86 arch:x86
6f1b0e75707dde3e56793bfc09494c99
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
GetModuleFileNameA
GetCurrentProcess
GetCurrentThreadId
GetLastError
CreateMutexA
lstrcatA
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
WriteProfileStringA
CopyFileA
DeleteFileA
GetSystemDirectoryA
GetProcAddress
VirtualAllocEx
GetProfileStringA
CreateFileA
VirtualFreeEx
lstrlenA
WaitForSingleObject
CreateRemoteThread
OpenProcess
DeviceIoControl
FreeLibrary
GlobalFree
LoadLibraryExA
GlobalAlloc
GetCurrentProcessId
GetFileSize
ExitProcess
GetPrivateProfileStringA
WriteFile
InitializeCriticalSection
GlobalUnlock
GlobalLock
VirtualProtectEx
IsBadReadPtr
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
GetCommandLineA
ReadProcessMemory
WriteProcessMemory
TerminateProcess
SetUnhandledExceptionFilter
GetCurrentThread
SetThreadContext
lstrcpyA
GetModuleHandleA
TerminateThread
ReadFile
CreateThread
user32
KillTimer
SetTimer
GetWindowThreadProcessId
FindWindowA
GetForegroundWindow
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
msvcrt
_strupr
_stricmp
sprintf
strrchr
memcpy
strstr
memset
strlen
??2@YAPAXI@Z
strcat
atoi
_strlwr
free
_initterm
malloc
_adjust_fdiv
wininet
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA
Exports
Exports
Sections
.text Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ