Static task
static1
Behavioral task
behavioral1
Sample
bce3a9fdc29c3cef8a66c642db88f7a6_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bce3a9fdc29c3cef8a66c642db88f7a6_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bce3a9fdc29c3cef8a66c642db88f7a6_JaffaCakes118
-
Size
14KB
-
MD5
bce3a9fdc29c3cef8a66c642db88f7a6
-
SHA1
9de056669b9464c421d5ba90be7214f715f08f3c
-
SHA256
5826ffc180bf2b7d491e5485524cbc97a736ed25f910c1d6c8ffea43075ec633
-
SHA512
c1fb4149437e0fb5601b6331f2c0e92fcb4a5eac20cfc69f4859aa8f4304e5b721b672de1011b513f2aa2b437d6eb0159adae15cf2835f097605cb1847bde16b
-
SSDEEP
384:U50/fOI2Xnp9Qt/aPjWWnvarMyQ1ccN+:U50Qp9QdWnIMb1VN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bce3a9fdc29c3cef8a66c642db88f7a6_JaffaCakes118
Files
-
bce3a9fdc29c3cef8a66c642db88f7a6_JaffaCakes118.dll windows:4 windows x86 arch:x86
d4337227c85125799f240f9cfd2b4a2f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
OpenProcess
GetProcAddress
GetModuleHandleA
DeleteFileA
CreateFileA
WriteFile
OpenEventA
Sleep
GetFileSize
ReadFile
GetModuleFileNameA
VirtualAllocEx
ReadProcessMemory
GlobalLock
GlobalAlloc
VirtualProtectEx
CreateThread
GetCurrentProcess
OutputDebugStringA
CreateEventA
SetThreadPriority
GetCommandLineA
WriteProcessMemory
VirtualFreeEx
CreateRemoteThread
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
VirtualFree
GlobalFree
VirtualAlloc
user32
GetKeyboardState
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
ToUnicode
GetAsyncKeyState
DeleteMenu
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
wsprintfA
GetInputState
PostThreadMessageA
GetMessageA
gdi32
DeleteObject
advapi32
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
wininet
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 788B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ