Static task
static1
Behavioral task
behavioral1
Sample
e23e06b2f5d752c69f53b76ede377eea_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e23e06b2f5d752c69f53b76ede377eea_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
e23e06b2f5d752c69f53b76ede377eea_JaffaCakes118
-
Size
19KB
-
MD5
e23e06b2f5d752c69f53b76ede377eea
-
SHA1
874c0ebe3344507430cc3af0e8fa3b3dce993629
-
SHA256
df8dc04469e901609216877f3eaaa7c6d85ea65f56ff38f3f2ad7836f1588cd9
-
SHA512
a1dbea5cb22170e47d44cdf9b11f179af8716c4f620065e4ee06ad82a5567f900edd1b75c4c887054bdeace02c60f054fc67d8bbdb6397bd81dca2b8046cf193
-
SSDEEP
192:XKMz2N42ngsmCczOKdrXofMRlbuRyiUl7LNSVassZEP82Kh09K6Sf8R/+:XFJsQOKdrXBv5BN55qXTHSfa/+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e23e06b2f5d752c69f53b76ede377eea_JaffaCakes118
Files
-
e23e06b2f5d752c69f53b76ede377eea_JaffaCakes118.dll windows:4 windows x86 arch:x86
5b0e801afa22ce481807e953eef0dfe8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WriteProcessMemory
VirtualAllocEx
GetProcAddress
GetModuleHandleA
FindClose
FindNextFileA
lstrcpynA
lstrcpyA
lstrcmpA
FindFirstFileA
VirtualProtectEx
LoadLibraryA
Module32Next
Module32First
ReadFile
GetModuleFileNameA
VirtualFreeEx
CreateRemoteThread
GetPrivateProfileStringA
CreateThread
Sleep
IsBadReadPtr
WinExec
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
OpenProcess
CreateMutexA
GetLastError
ReleaseMutex
GetSystemDirectoryA
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
Process32Next
lstrlenA
WaitForSingleObject
CreateFileA
WriteFile
CloseHandle
GetTempPathA
user32
wsprintfA
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
advapi32
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
shlwapi
StrStrIA
wininet
InternetCloseHandle
netapi32
Netbios
msvcrt
sprintf
strcmp
_purecall
memcpy
??2@YAPAXI@Z
strstr
strncat
strcat
memset
??3@YAXPAX@Z
_itoa
strcpy
Sections
.bss Size: - Virtual size: 17KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: 1024B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ