Static task
static1
Behavioral task
behavioral1
Sample
b61ccbe8271fc9d625f62d947da15d43_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b61ccbe8271fc9d625f62d947da15d43_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b61ccbe8271fc9d625f62d947da15d43_JaffaCakes118
-
Size
32KB
-
MD5
b61ccbe8271fc9d625f62d947da15d43
-
SHA1
92ba1b97746f9d90cb3d975d8604f6d24459a6b7
-
SHA256
c0bcad900d9ff65fd9d04faa8477d31205d9560a981b65643a8181a618ccd22a
-
SHA512
ceb6951993832a69a93478189708a5e02aeef50fd156783aad6d3454b51812f48932ded00292a7e10bede293504541398b05b67996521eb76dd5e98c1665638b
-
SSDEEP
768:SNciREAPc3eXFuDN4JCFIEwEckig37YRQgFFk1HMVva:+cirCVvmg37MAd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b61ccbe8271fc9d625f62d947da15d43_JaffaCakes118
Files
-
b61ccbe8271fc9d625f62d947da15d43_JaffaCakes118.dll windows:4 windows x86 arch:x86
654dfdfbcd4bcc29201edda36b6bf003
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExitProcess
CloseHandle
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
WriteFile
DeleteFileA
InitializeCriticalSection
GetModuleHandleA
VirtualProtectEx
VirtualProtect
GetPrivateProfileStringA
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
LoadLibraryA
SetThreadContext
OpenThread
GetComputerNameA
CreateRemoteThread
VirtualAllocEx
OpenProcess
lstrlenA
MultiByteToWideChar
TerminateProcess
CreateProcessA
GetSystemDirectoryA
GetCurrentThreadId
GetCurrentProcess
WriteProcessMemory
ReadProcessMemory
GetCurrentProcessId
CreateMutexA
GetLastError
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCommandLineA
IsBadReadPtr
TerminateThread
SetUnhandledExceptionFilter
CreateThread
user32
UnhookWindowsHookEx
SetWindowsHookExA
FindWindowA
GetWindow
GetWindowThreadProcessId
CallNextHookEx
GetWindowTextA
GetClassNameA
GetDesktopWindow
msvcrt
_initterm
malloc
_adjust_fdiv
_strnicmp
_stricmp
_strupr
_strlwr
free
??2@YAPAXI@Z
memcpy
strrchr
memset
strcat
sprintf
strcpy
strlen
strncpy
strstr
strchr
strcmp
wcslen
fclose
fread
fopen
atoi
??3@YAXPAX@Z
wininet
InternetCloseHandle
InternetReadFile
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ