Static task
static1
Behavioral task
behavioral1
Sample
be885a64fe8cc4a0e42c0dd9a7eeae92_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
be885a64fe8cc4a0e42c0dd9a7eeae92_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
be885a64fe8cc4a0e42c0dd9a7eeae92_JaffaCakes118
-
Size
31KB
-
MD5
be885a64fe8cc4a0e42c0dd9a7eeae92
-
SHA1
26201ee78ae304665fc393d96a120f68a0595365
-
SHA256
77242381ae4b23ec1c2fbcc97e2096446b5b1608cf93655b575cac541bca4521
-
SHA512
4544482b1fff7082c563b352d1640d8c10edbc4f8602ce3c7dd0ae967685500080d588a362d6f2c94918d39537ad12c6b57d5aebacca56841b3b17fa246761a2
-
SSDEEP
768:RvF3eK7BLF/JEhKLcCR1RQADyXqfyRipRCQ4H:Rv8K9LFhE0miyBRipRCQ4H
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be885a64fe8cc4a0e42c0dd9a7eeae92_JaffaCakes118
Files
-
be885a64fe8cc4a0e42c0dd9a7eeae92_JaffaCakes118.dll windows:4 windows x86 arch:x86
7826f274c19de19a7dc3e42ba54e5104
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
CreateEventA
SetEvent
WriteFile
CreateMutexA
GetCurrentProcessId
ExitProcess
GetModuleHandleA
IsBadReadPtr
GetCommandLineA
GetTickCount
TerminateProcess
OpenProcess
ResumeThread
WriteProcessMemory
VirtualProtectEx
GetModuleFileNameA
GetProcAddress
ReadProcessMemory
GetCurrentProcess
WaitForSingleObject
DisableThreadLibraryCalls
RaiseException
InitializeCriticalSection
GetPrivateProfileStringA
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
Process32Next
Process32First
CreateToolhelp32Snapshot
ResetEvent
CreateFileA
ReadFile
CloseHandle
DeleteFileA
GetTempPathA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
TerminateThread
CreateThread
GetCurrentThreadId
Sleep
user32
SetWindowsHookExA
UnhookWindowsHookEx
GetForegroundWindow
GetWindowTextA
FindWindowA
GetWindowThreadProcessId
GetKeyState
CallNextHookEx
imagehlp
ImageUnload
ImageLoad
shlwapi
PathFileExistsA
msvcrt
free
_initterm
_strnicmp
malloc
_adjust_fdiv
_stricmp
_strlwr
fopen
fread
fclose
wcslen
strcmp
strncpy
sprintf
strcpy
strlen
strstr
strcat
memcpy
memset
??2@YAPAXI@Z
strrchr
rand
srand
wininet
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ