Static task
static1
Behavioral task
behavioral1
Sample
0063be84b73b00a2ae097e253718d195_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
0063be84b73b00a2ae097e253718d195_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0063be84b73b00a2ae097e253718d195_JaffaCakes118
-
Size
19KB
-
MD5
0063be84b73b00a2ae097e253718d195
-
SHA1
7f84dca9857d4f6492bad22bca64b321db0e30a3
-
SHA256
5e37addc3191412e6eacf6d15c0831ba1292bf8bea324f7f4de23b52dee05617
-
SHA512
6a8ddf606d312fa78ffe53d372ced8a3313b54b3364699248a914aedb20cd6fa8b37c8dcf8cd5604a4cf9f2054c0999bf16fc6d84c4502146a62d470507382fa
-
SSDEEP
384:z4iGJfnthL7qZ3guujtN1OvejcyILO/IM6KZ:z7GJfvL7I3gN1OveELOQM6KZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0063be84b73b00a2ae097e253718d195_JaffaCakes118
Files
-
0063be84b73b00a2ae097e253718d195_JaffaCakes118.dll windows:4 windows x86 arch:x86
af9fa86c2484b12faa27eb4163cc347a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalLock
GlobalAlloc
GetCommandLineA
Sleep
GetCurrentProcessId
ReadProcessMemory
GetCurrentProcess
IsBadReadPtr
GetProcAddress
GetModuleHandleA
WriteProcessMemory
GlobalUnlock
ExitProcess
TerminateProcess
OpenProcess
GetCurrentThreadId
CreateRemoteThread
GlobalFree
VirtualAllocEx
DeleteFileA
CreateFileA
WriteFile
GetFileSize
ReadFile
VirtualProtectEx
TerminateThread
SetThreadPriority
VirtualAlloc
VirtualFree
Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleFileNameA
OpenEventA
CreateEventA
CreateThread
VirtualFreeEx
CloseHandle
user32
GetInputState
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
wsprintfA
GetWindowThreadProcessId
PostThreadMessageA
FindWindowA
GetMessageA
GetWindowTextA
wininet
InternetOpenUrlA
InternetCloseHandle
InternetOpenA
advapi32
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ