Static task
static1
Behavioral task
behavioral1
Sample
fa83d289c03f47780f7c3b1d769c6a3c_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fa83d289c03f47780f7c3b1d769c6a3c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fa83d289c03f47780f7c3b1d769c6a3c_JaffaCakes118
-
Size
26KB
-
MD5
fa83d289c03f47780f7c3b1d769c6a3c
-
SHA1
0bd813ad840d7437417b4756a5c17d025062ffa0
-
SHA256
68f2671bd2212f101e50a6f06dece2bbe5f7dd9b2cbe6708d87d882ceca8a336
-
SHA512
b4517f3c9c07e9772aa6100437d49f5ffea43bdbcd157e2a023a53509b60b9513cd96e87f936fbf9dcfd2debcf03d8d4bed35d7ee39e3a43f9ebe7dc835cecc3
-
SSDEEP
384:uzZ4tHgbvGmJesSIA+C1ZuZzDERy6jcx+YlUEw3Yn05EVDufh71iU2O5G3wEVDit:uF4tH0GmJeKERRcxZlUER0U+78eG3wm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa83d289c03f47780f7c3b1d769c6a3c_JaffaCakes118
Files
-
fa83d289c03f47780f7c3b1d769c6a3c_JaffaCakes118.dll windows:4 windows x86 arch:x86
96c25e67c6b6d930fb39be9ebe7d2a8c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalLock
GlobalAlloc
Sleep
InitializeCriticalSection
TerminateProcess
TerminateThread
IsBadReadPtr
GetPrivateProfileStringA
RaiseException
CloseHandle
WideCharToMultiByte
ReadProcessMemory
GetModuleHandleA
SetUnhandledExceptionFilter
ResumeThread
SetThreadContext
GlobalUnlock
OpenThread
GetCurrentThread
Process32Next
Process32First
CreateToolhelp32Snapshot
WriteProcessMemory
GlobalFree
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
GetCurrentProcess
GetCurrentThreadId
VirtualProtectEx
GetModuleFileNameA
CreateThread
GetCurrentProcessId
CreateMutexA
OpenMutexA
SuspendThread
user32
FindWindowA
GetWindowThreadProcessId
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
ws2_32
WSASetLastError
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
msvcrt
??3@YAXPAX@Z
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
wcslen
fopen
fread
fclose
strcat
sprintf
strcpy
strrchr
memcpy
atoi
strchr
memset
??2@YAPAXI@Z
strncpy
_strlwr
sscanf
strlen
strstr
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ