?QQStart@@YGXK@Z
Static task
static1
Behavioral task
behavioral1
Sample
046e4edd4087008186bcc0f276d08847_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
046e4edd4087008186bcc0f276d08847_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
046e4edd4087008186bcc0f276d08847_JaffaCakes118
-
Size
66KB
-
MD5
046e4edd4087008186bcc0f276d08847
-
SHA1
b85942deb7d6c74442e8e96a9344573337a2b2f7
-
SHA256
b9079aa967baa788fddbd24626af0718c923a9500d1ac6c239f7c8a0bd6c5f31
-
SHA512
bbd93b6b882082ba95685df9c2c329a28291e27ea37d5529025681d91f32adad24bba62da8f2dfdc46fda11065a4dc81e80817784fa462f279195437a07049fe
-
SSDEEP
1536:EvoVLEKU+RN3Z2CAzHTHw02Y8rkaVINMwmpk:tBnjIzH2lrnINM5y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 046e4edd4087008186bcc0f276d08847_JaffaCakes118
Files
-
046e4edd4087008186bcc0f276d08847_JaffaCakes118.dll windows:4 windows x86 arch:x86
02401518d107128bbe4f985673634a06
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
winmm
sndPlaySoundA
urlmon
URLDownloadToFileA
wininet
DeleteUrlCacheEntry
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
kernel32
lstrcpynA
GetModuleHandleA
Process32Next
Process32First
CreateToolhelp32Snapshot
CloseHandle
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
OpenProcess
CreateThread
GetLastError
GetModuleFileNameA
GetProcAddress
FreeLibrary
LoadLibraryA
GetSystemDirectoryA
GetPrivateProfileStringA
GetTickCount
GetVersionExA
WriteFile
CreateFileA
SetFilePointer
GetLocalTime
ReadFile
GetPrivateProfileIntA
LocalFree
FindResourceA
LoadResource
SizeofResource
GlobalLock
GlobalUnlock
MultiByteToWideChar
Sleep
DeleteFileA
ExitProcess
GlobalAlloc
GlobalFree
CreateDirectoryA
LocalAlloc
CreateMutexA
user32
LoadIconA
GetWindowTextA
FindWindowExA
FindWindowA
GetWindowThreadProcessId
SendMessageA
CharLowerA
SetWindowLongA
GetWindowLongA
CreateDialogParamA
IsWindow
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
RegisterClassExA
UpdateWindow
CreateWindowExA
PostQuitMessage
DestroyIcon
SetWindowPos
SetWindowRgn
GetCursorPos
GetDC
GetClassLongA
FillRect
ReleaseDC
MoveWindow
SetTimer
DefWindowProcA
ShowWindow
PtInRect
LoadCursorA
SetCursor
KillTimer
GetWindowDC
wsprintfA
GetWindowRect
GetSystemMetrics
gdi32
SelectObject
BitBlt
GetObjectA
CreateCompatibleDC
CreatePolygonRgn
TextOutA
SetTextColor
CreateFontA
SetPixel
SetBkMode
GetTextExtentPoint32A
GetStockObject
LineTo
MoveToEx
CreatePen
Rectangle
CreateSolidBrush
CreateCompatibleBitmap
StretchBlt
DeleteObject
advapi32
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCloseKey
shell32
ShellExecuteA
Shell_NotifyIconA
ole32
CreateStreamOnHGlobal
gdiplus
GdiplusShutdown
GdipLoadImageFromStream
GdipCreateBitmapFromFile
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdipDisposeImage
Exports
Exports
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ