Static task
static1
Behavioral task
behavioral1
Sample
cf3a8fdfb618ed6d54f8ac1ada42799d_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cf3a8fdfb618ed6d54f8ac1ada42799d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
cf3a8fdfb618ed6d54f8ac1ada42799d_JaffaCakes118
-
Size
29KB
-
MD5
cf3a8fdfb618ed6d54f8ac1ada42799d
-
SHA1
26dfe7c0a485035e4ea6888e30ec411144249a0d
-
SHA256
be2da909d342867e3af6c868324e1c5b820c2f9dc1dc3552a6d14a19a682f36b
-
SHA512
5a695ea2c9bea2b23229a3d5b234bf83f30a6b95b651e19e47b564054f22601ce633830b816d8ee6ef5005901048da76b2aaa9ec1e4739b001392362ba711892
-
SSDEEP
384:sxDyirDxG18MthJN5BU1LmjahcbhD3Ed2OU24h21YkhqLch21Ya:CDyGG18MtjNUlJmD3+PYOqLcW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cf3a8fdfb618ed6d54f8ac1ada42799d_JaffaCakes118
Files
-
cf3a8fdfb618ed6d54f8ac1ada42799d_JaffaCakes118.dll windows:4 windows x86 arch:x86
ff9d9f1c68cf9528c652d5f639a04606
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ResumeThread
WriteProcessMemory
VirtualProtectEx
OpenProcess
GetModuleFileNameA
GetProcAddress
ReadProcessMemory
GetCurrentProcess
GetModuleHandleA
GetPrivateProfileStringA
WideCharToMultiByte
MultiByteToWideChar
CreateProcessA
VirtualAlloc
LoadLibraryA
CloseHandle
CreateFileA
GetSystemDirectoryA
GetCurrentThreadId
ExitProcess
ReadFile
SetFilePointer
WriteFile
DeleteFileA
InitializeCriticalSection
VirtualProtect
LeaveCriticalSection
EnterCriticalSection
lstrlenA
TerminateProcess
GetTickCount
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCommandLineA
IsBadReadPtr
TerminateThread
CreateThread
GetCurrentProcessId
CreateMutexA
DisableThreadLibraryCalls
GetLastError
user32
UnhookWindowsHookEx
CallNextHookEx
GetWindowTextA
FindWindowA
GetWindowThreadProcessId
GetForegroundWindow
SetWindowsHookExA
advapi32
RegSetValueExA
RegCloseKey
RegCreateKeyExA
imagehlp
ImageLoad
ImageUnload
shlwapi
PathFileExistsA
msvcrt
fread
fopen
strcmp
_strupr
wcslen
_stricmp
_strlwr
_strcmpi
fclose
strstr
strchr
strncpy
??3@YAXPAX@Z
atoi
strcat
sprintf
strcpy
??2@YAPAXI@Z
memcpy
strrchr
memset
rand
srand
strlen
wininet
InternetCloseHandle
InternetReadFile
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ