Static task
static1
Behavioral task
behavioral1
Sample
0263e92207d52c8d2d9d88af300761f6_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0263e92207d52c8d2d9d88af300761f6_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0263e92207d52c8d2d9d88af300761f6_JaffaCakes118
-
Size
21KB
-
MD5
0263e92207d52c8d2d9d88af300761f6
-
SHA1
b5300669da6e8ca5d41eb282745bb6c2a1ad16b8
-
SHA256
5a2d7b7bae5ad8d0f57ee33d797deba966c2531018370083b4690842b04aeb87
-
SHA512
dff24fc3b3baf554c77a7beff8c2cfcdfd9b7247a5b3091441e7b0db1413867ad0e4ac6895ab4741c05a36f2d7faa6b77bf4da999630ff5045aa7704fdf2a523
-
SSDEEP
384:2VljBL901CwvZpTqKSOM3pdcJtIyDRrM/GIX7K5Mtq8ZNrbZ:2G19/pw3p+Jt1Rg/GX5MXbZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0263e92207d52c8d2d9d88af300761f6_JaffaCakes118
Files
-
0263e92207d52c8d2d9d88af300761f6_JaffaCakes118.dll windows:4 windows x86 arch:x86
0e88210b648255ae840a0abe0d55e340
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ReadProcessMemory
VirtualQueryEx
WideCharToMultiByte
GetFileSize
SetFilePointer
GetProcAddress
HeapAlloc
GetProcessHeap
OutputDebugStringA
GetFileAttributesW
GetModuleHandleA
CloseHandle
GetTempPathA
DeleteFileA
GetModuleFileNameA
CreateFileA
ReadFile
LoadLibraryA
GetCurrentProcessId
OpenProcess
TerminateProcess
GetCurrentProcess
Sleep
user32
GetDC
GetWindowRect
wsprintfA
GetWindow
GetClassNameW
wininet
InternetCloseHandle
msvcrt
_strupr
_strcmpi
strcat
memset
sprintf
strlen
strcpy
??3@YAXPAX@Z
wcscmp
??2@YAPAXI@Z
ftell
fseek
fopen
mbstowcs
strncpy
strrchr
free
rand
srand
time
wcslen
strstr
wcsncat
wcscpy
wcsstr
exit
printf
malloc
_stricmp
memcpy
_except_handler3
_local_unwind2
strcmp
_vsnprintf
iphlpapi
GetAdaptersInfo
gdiplus
GdipGetImageEncodersSize
GdipDisposeImage
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipGetImageEncoders
gdi32
BitBlt
CreateCompatibleDC
GetDeviceCaps
CreateDCA
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ