___CPPdebugHook
Static task
static1
Behavioral task
behavioral1
Sample
db4648c9eada682b92ddcc1810fe67eb_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
db4648c9eada682b92ddcc1810fe67eb_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
db4648c9eada682b92ddcc1810fe67eb_JaffaCakes118
-
Size
67KB
-
MD5
db4648c9eada682b92ddcc1810fe67eb
-
SHA1
a8ba0bfcf34bbddd58794e362cdc369508343704
-
SHA256
41aa18f200dd84142f84c9ab1faf8a9baaa8a0da60dd3f6760d420437bd3f058
-
SHA512
50449da4ee55ad569ca83877c41026b63b74901b42838f684d4a11cf35b3e15a47a143a7c51a9d5eed594a40da4882047033d7ec316b0540524be61a96d3b691
-
SSDEEP
1536:bXCBLFUMqwh+j29AFAKmh+9C38s5yCNfcGMGdQH:bULFUMqwYdm58iyCNFQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db4648c9eada682b92ddcc1810fe67eb_JaffaCakes118
Files
-
db4648c9eada682b92ddcc1810fe67eb_JaffaCakes118.dll windows:4 windows x86 arch:x86
b4651c6e144daa2b3139b66a5275cad5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CreateFileA
CreateThread
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsA
GetACP
GetCPInfo
GetCurrentThreadId
GetEnvironmentStrings
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetTimeZoneInformation
GetVersion
GetVersionExA
GlobalAlloc
GlobalFree
GlobalMemoryStatus
HeapAlloc
HeapFree
InitializeCriticalSection
LCMapStringA
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
OpenFile
RaiseException
ReadFile
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WideCharToMultiByte
WriteFile
GetVolumeInformationA
wsock32
WSACleanup
WSAStartup
accept
closesocket
connect
gethostbyname
htons
listen
recv
send
shutdown
socket
bind
user32
EnumThreadWindows
MessageBoxA
wsprintfA
Exports
Exports
Sections
.text Size: 45KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ