Static task
static1
Behavioral task
behavioral1
Sample
f01b424ee014d4f5c01182008c76380c_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f01b424ee014d4f5c01182008c76380c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f01b424ee014d4f5c01182008c76380c_JaffaCakes118
-
Size
51KB
-
MD5
f01b424ee014d4f5c01182008c76380c
-
SHA1
0d581e01402011ee0051db8f5d90b11a33d98b4e
-
SHA256
ab27b2510af336e4d44b0475b07ce306ba00f2e9ebd8992ea309023734296a72
-
SHA512
e560f2d954726fdaf0ee1a7ecbfd2917af4246b13e6e711b79b88d5704a16ef6f6465b5adbf4421c656a240396f15058f0810ad66984fd2e44dbd288f734e590
-
SSDEEP
768:7xmmzpL8vtEKCX5/jx38tDVQBWq7kMFmB/m3OLrzsUDy4i1zN0AIOcVnToIf16P:7xDFgvtEKi/r4GN0AIOcVnToIfAP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f01b424ee014d4f5c01182008c76380c_JaffaCakes118
Files
-
f01b424ee014d4f5c01182008c76380c_JaffaCakes118.dll windows:4 windows x86 arch:x86
872e458507cacb055dc2258ada3c9946
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
SendMessageA
mouse_event
GetSystemMetrics
GetDC
GetDesktopWindow
ReleaseDC
SetWindowPos
kernel32
CreateFileA
CreateIoCompletionPort
CreateThread
CreateToolhelp32Snapshot
FindClose
FindFirstFileA
CloseHandle
GetFileSize
GetLogicalDriveStringsA
GetProcAddress
GetQueuedCompletionStatus
GetSystemInfo
GlobalAlloc
GlobalFree
LoadLibraryA
OpenProcess
PostQueuedCompletionStatus
Process32First
Process32Next
ReadFile
RtlMoveMemory
RtlZeroMemory
FindNextFileA
TerminateProcess
WriteFile
lstrcatA
lstrcmpA
lstrlenA
Sleep
gdi32
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
SetDIBitsToDevice
SelectObject
GetDIBits
DeleteObject
DeleteDC
BitBlt
ws2_32
WSAStartup
connect
gethostbyname
htons
socket
WSASend
WSARecv
WSAGetLastError
WSACleanup
closesocket
shell32
ShellExecuteA
msvcrt
free
malloc
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 808B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ