Static task
static1
Behavioral task
behavioral1
Sample
dc6fcc236017c3c8c6b7de90521f0a2c_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dc6fcc236017c3c8c6b7de90521f0a2c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
dc6fcc236017c3c8c6b7de90521f0a2c_JaffaCakes118
-
Size
131KB
-
MD5
dc6fcc236017c3c8c6b7de90521f0a2c
-
SHA1
9db4bb5a642e518285d2fcb4d3fbf9ab728bb1e2
-
SHA256
d8697f698a24b82be9348cc9c9a69c9efce7aaecc63165fbd596f7729fba8db7
-
SHA512
79ed27ceae04e513506bc09b6341ef110feaa13ed64e2ecf41c5edfa143305d597e36f1b3d1cd937a798101b3087e086f272f61abd00b296107f89f711788837
-
SSDEEP
768:9JOeOlrPoufc2qqryu4VCfHfmDPfqfHRx2L:9xOLco4PsRx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc6fcc236017c3c8c6b7de90521f0a2c_JaffaCakes118
Files
-
dc6fcc236017c3c8c6b7de90521f0a2c_JaffaCakes118.dll windows:4 windows x86 arch:x86
7826f274c19de19a7dc3e42ba54e5104
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
CreateEventA
SetEvent
WriteFile
CreateMutexA
GetCurrentProcessId
ExitProcess
GetModuleHandleA
IsBadReadPtr
GetCommandLineA
GetTickCount
TerminateProcess
OpenProcess
ResumeThread
WriteProcessMemory
VirtualProtectEx
GetModuleFileNameA
GetProcAddress
ReadProcessMemory
GetCurrentProcess
WaitForSingleObject
DisableThreadLibraryCalls
RaiseException
InitializeCriticalSection
GetPrivateProfileStringA
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
Process32Next
Process32First
CreateToolhelp32Snapshot
ResetEvent
CreateFileA
ReadFile
CloseHandle
DeleteFileA
GetTempPathA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
TerminateThread
CreateThread
GetCurrentThreadId
Sleep
user32
SetWindowsHookExA
UnhookWindowsHookEx
GetForegroundWindow
GetWindowTextA
FindWindowA
GetWindowThreadProcessId
GetKeyState
CallNextHookEx
imagehlp
ImageUnload
ImageLoad
shlwapi
PathFileExistsA
msvcrt
free
_initterm
_strnicmp
malloc
_adjust_fdiv
_stricmp
_strlwr
fopen
fread
fclose
wcslen
strcmp
strncpy
sprintf
strcpy
strlen
strstr
strcat
memcpy
memset
??2@YAPAXI@Z
strrchr
rand
srand
wininet
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ