Static task
static1
Behavioral task
behavioral1
Sample
d615057c69360799f688457ae046c3a5_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d615057c69360799f688457ae046c3a5_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d615057c69360799f688457ae046c3a5_JaffaCakes118
-
Size
60KB
-
MD5
d615057c69360799f688457ae046c3a5
-
SHA1
2c2a1e629498402693c01422a00bac850480659a
-
SHA256
1396fc15f82c9fc2d2b188883abf2c23d0f974a29587d471a5f82fbf31d58667
-
SHA512
e6cae8f51aada481cc7cd522942ac0603f180ad3b0e69f5cf74a86ecd8de92acbb3fece9d8e2ac5a8fa0994c7f07bf4b261239ded48361287a488e113879d5ce
-
SSDEEP
768:2ahH1PYQs1ImrIS/3bQpkQxcUQstXZ94dTG:2ewJrF/rQpkQeCtJ9aG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d615057c69360799f688457ae046c3a5_JaffaCakes118
Files
-
d615057c69360799f688457ae046c3a5_JaffaCakes118.dll windows:4 windows x86 arch:x86
58fde0ef3721a7aff0acfbc0107ae5dd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
GetProcAddress
Sleep
LocalAlloc
MultiByteToWideChar
VirtualProtect
CreateThread
GetCurrentProcessId
GetPrivateProfileStringA
GetSystemDirectoryA
GetTickCount
WritePrivateProfileStringA
VirtualAlloc
VirtualFree
VirtualQuery
HeapCreate
GetSystemInfo
lstrcpyA
GetModuleFileNameA
InterlockedIncrement
LoadLibraryA
GetCommandLineA
Process32Next
TerminateProcess
OpenProcess
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
ReadProcessMemory
VirtualProtectEx
WriteProcessMemory
GetCurrentProcess
Module32Next
Module32First
lstrlenW
WideCharToMultiByte
IsBadReadPtr
OpenFileMappingA
CloseHandle
CreateFileMappingA
MapViewOfFile
lstrlenA
UnmapViewOfFile
user32
wsprintfA
advapi32
CryptCreateHash
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CryptHashData
shlwapi
StrStrIA
StrStrW
StrStrA
msvcrt
??2@YAPAXI@Z
_stricmp
_memicmp
_adjust_fdiv
_initterm
isprint
strstr
sscanf
__CxxFrameHandler
sprintf
??3@YAXPAX@Z
_itoa
isspace
isalnum
free
malloc
atol
strrchr
Sections
.text Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ