Static task
static1
Behavioral task
behavioral1
Sample
c1dd52c1e07daff036633bfcb07bc574_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c1dd52c1e07daff036633bfcb07bc574_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c1dd52c1e07daff036633bfcb07bc574_JaffaCakes118
-
Size
33KB
-
MD5
c1dd52c1e07daff036633bfcb07bc574
-
SHA1
4362af5ebdd6957803a312d97511b2a220693e4a
-
SHA256
4057cff586f742be8489d09d8be854ca0b739c9daac9ffc9eb65c3482d1b133c
-
SHA512
fec637c984d63874c8acdc71ed91a3d38322382dea016c826f6e643f7a08332dcbd9c211e4574d9b3447e440c102b170fd188507324866248f6fa344046637db
-
SSDEEP
192:vKKeGOkqDkYsSJrxx8WSPdkyaJHvokYK4e6/3CC2ucuK584JM:+GlGrQ/lzaJoAWKi4JM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c1dd52c1e07daff036633bfcb07bc574_JaffaCakes118
Files
-
c1dd52c1e07daff036633bfcb07bc574_JaffaCakes118.dll windows:4 windows x86 arch:x86
2ac8c890aa908cc5918a35eb17154ce6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcessId
lstrcpyA
GetWindowsDirectoryA
GetProcAddress
LoadLibraryA
CreateFileA
ReadFile
Module32First
GetModuleHandleA
LocalAlloc
CreateThread
Sleep
IsBadReadPtr
GetModuleFileNameA
Module32Next
lstrlenA
ReadProcessMemory
OpenProcess
VirtualProtectEx
WriteProcessMemory
CreateToolhelp32Snapshot
CloseHandle
user32
GetWindowTextA
GetForegroundWindow
wsprintfA
advapi32
CryptCreateHash
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextA
CryptHashData
shlwapi
StrStrIA
msvcrt
??3@YAXPAX@Z
_purecall
memcmp
strcmp
memcpy
??2@YAPAXI@Z
isprint
strlen
strstr
memset
strchr
_itoa
Sections
.bss Size: - Virtual size: 64.1MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
shard Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ