Static task
static1
Behavioral task
behavioral1
Sample
c272baacd6b478cb051615213423813f_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c272baacd6b478cb051615213423813f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c272baacd6b478cb051615213423813f_JaffaCakes118
-
Size
56KB
-
MD5
c272baacd6b478cb051615213423813f
-
SHA1
793a84dbe7e14ece7baff031999b1ee7e0365942
-
SHA256
104b29fb0e0b85594dffa3d25eae740ad9f0a2374ff219d2be066da0c18e3205
-
SHA512
a13cbfdc25107f644fb9bd18da251190d78f56a95a96c90dd4bd4361f3b16aee9df2cb15142d3bde14cd6f95eab0278cd8b60cb139f16858d09f6b3cbfe9af3d
-
SSDEEP
768:f1H8hcAZrnsPv5+KwUNU5/ldN12p9371:uhLDsPv5+KjNU5/ldN1O9p
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c272baacd6b478cb051615213423813f_JaffaCakes118
Files
-
c272baacd6b478cb051615213423813f_JaffaCakes118.dll windows:4 windows x86 arch:x86
405f756ebbe396623a78e39bad0ae9e7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
GetProcAddress
Sleep
LocalAlloc
MultiByteToWideChar
VirtualProtect
CreateThread
GetCurrentProcessId
GetPrivateProfileStringA
GetSystemDirectoryA
GetTickCount
WritePrivateProfileStringA
VirtualAlloc
VirtualFree
VirtualQuery
HeapCreate
GetSystemInfo
lstrcpyA
GetModuleFileNameA
InterlockedIncrement
LoadLibraryA
GetCommandLineA
Process32Next
TerminateProcess
OpenProcess
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
ReadProcessMemory
VirtualProtectEx
WriteProcessMemory
GetCurrentProcess
Module32Next
Module32First
lstrlenW
WideCharToMultiByte
IsBadReadPtr
OpenFileMappingA
CloseHandle
CreateFileMappingA
MapViewOfFile
lstrlenA
UnmapViewOfFile
user32
wsprintfA
advapi32
CryptCreateHash
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CryptHashData
shlwapi
StrStrIA
StrStrW
StrStrA
msvcrt
??3@YAXPAX@Z
_stricmp
_memicmp
_adjust_fdiv
_initterm
isprint
memcpy
strlen
memset
strstr
sscanf
strcpy
strcmp
__CxxFrameHandler
sprintf
_itoa
??2@YAPAXI@Z
memcmp
strcat
isspace
isalnum
free
malloc
atol
strrchr
Sections
.text Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ