Static task
static1
Behavioral task
behavioral1
Sample
ef0d3a29a74fcfc7ee0307ec69f6c38c_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ef0d3a29a74fcfc7ee0307ec69f6c38c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ef0d3a29a74fcfc7ee0307ec69f6c38c_JaffaCakes118
-
Size
2.2MB
-
MD5
ef0d3a29a74fcfc7ee0307ec69f6c38c
-
SHA1
6a92957eabc996b77afd1ea0e47909d8922476a0
-
SHA256
263d18da90672b0ff28a36834014bf2430979148b65d1ce3e111f48a04430e45
-
SHA512
e302e1cf0364d0559027a4e98052cadb8ddcaa3a1ec709d251a23e5adab689a8758c14adaa145b65ec6f315155c4f6a22183c017f3ddedf9eeb3d7c161e2a96b
-
SSDEEP
49152:RVk6y3tQu2XG8ZoI9Z9rqyI44HppuzGxHHY4L2q5HkLB:R26y3SWGoqZ92yVG/uzGNV9Hkd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef0d3a29a74fcfc7ee0307ec69f6c38c_JaffaCakes118
Files
-
ef0d3a29a74fcfc7ee0307ec69f6c38c_JaffaCakes118.dll windows:4 windows x86 arch:x86
9eebbd1e1d2da18af116f6695a4d4a44
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateEventA
OpenEventA
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
CloseHandle
SetEvent
GetFileSize
ReadFile
SetFilePointer
CreateFileA
HeapAlloc
GetProcessHeap
VirtualProtect
IsBadReadPtr
GetProcAddress
GetModuleHandleA
LoadLibraryW
MultiByteToWideChar
LoadLibraryA
GetPrivateProfileStringA
Sleep
CreateThread
user32
BroadcastSystemMessageA
SetWindowsHookExA
CallNextHookEx
wvsprintfA
wsprintfA
msvcrt
malloc
_strcmpi
_adjust_fdiv
strchr
atoi
strncpy
strcat
strcpy
strncmp
strlen
memset
strncat
free
memcpy
_except_handler3
strrchr
realloc
strstr
_strlwr
_initterm
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ