Static task
static1
Behavioral task
behavioral1
Sample
fb7f1369d5b64e652eec0d0d0a938daf_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
fb7f1369d5b64e652eec0d0d0a938daf_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fb7f1369d5b64e652eec0d0d0a938daf_JaffaCakes118
-
Size
27KB
-
MD5
fb7f1369d5b64e652eec0d0d0a938daf
-
SHA1
5adeca47e63e69542788b8e888fe2012ba47deae
-
SHA256
ebd95aced9c5e2dbbb7adcfe1832453da43661959a44fe14a005f618a7fb66b5
-
SHA512
2f64c1b5e6de93966b9cb2459be1bfe241d37d1d6aaa2ff9e98f45efd19f98531309202d8658b506d94b85f858c226a999fc5db0433757348fe0bf8262125169
-
SSDEEP
768:Dt83aDV4fQAcjtjb1wTDipYoUXxDTmT27C:DAa54IHUCpaFTJC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fb7f1369d5b64e652eec0d0d0a938daf_JaffaCakes118
Files
-
fb7f1369d5b64e652eec0d0d0a938daf_JaffaCakes118.dll windows:4 windows x86 arch:x86
bb6fc96e14026eb6832b5bb971ce6a59
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
CreateThread
TerminateThread
IsBadReadPtr
GetCommandLineA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CreateMutexA
GetCurrentProcessId
VirtualAlloc
GetPrivateProfileStringA
ExitProcess
GetCurrentThread
GetModuleFileNameA
VirtualProtectEx
ReadFile
RaiseException
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
OpenProcess
WriteProcessMemory
Process32Next
Process32First
CreateToolhelp32Snapshot
DeleteFileA
GetTempPathA
LoadLibraryA
GetProcAddress
ReadProcessMemory
VirtualProtect
GetModuleHandleA
GetCurrentProcess
TerminateProcess
CreateFileA
WriteFile
CloseHandle
GetCurrentThreadId
Sleep
user32
GetWindowTextA
CallNextHookEx
GetWindowThreadProcessId
FindWindowA
GetForegroundWindow
SetWindowsHookExA
UnhookWindowsHookEx
wininet
InternetReadFile
InternetCloseHandle
ws2_32
closesocket
msvcrt
free
_initterm
malloc
_adjust_fdiv
_strlwr
_strupr
_stricmp
fopen
fread
fclose
strcpy
sprintf
strlen
memcpy
memset
strcat
??2@YAPAXI@Z
strrchr
atoi
strcmp
wcslen
strstr
Sections
.text Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ