Static task
static1
Behavioral task
behavioral1
Sample
05fc0d093e6a6e01d4d895d02c82ec9f_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
05fc0d093e6a6e01d4d895d02c82ec9f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
05fc0d093e6a6e01d4d895d02c82ec9f_JaffaCakes118
-
Size
44KB
-
MD5
05fc0d093e6a6e01d4d895d02c82ec9f
-
SHA1
2ce889b2620eb1140cfba593827570acbef1f739
-
SHA256
fd105922ef4b01e602b070c70c4d163c8bf5639b6f68da6274cb8c8595a1de96
-
SHA512
79ba173a047de71f6ac21db1881239137ae870a823cde6d4355e028ba8fb736b06153c5ce1471f67c76997d6f988c4efcf6cd25c9091333b9e04dcb0d675e9e1
-
SSDEEP
384:DOhwPDRIT9rJvYHtYdL4HNl775t2kS4MfR3zySQJ1W6uZg4+jHUAdvlREzZ5:FVIT9rJvYNHNlXH2kSxzaJ1W60Z+Zvl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 05fc0d093e6a6e01d4d895d02c82ec9f_JaffaCakes118
Files
-
05fc0d093e6a6e01d4d895d02c82ec9f_JaffaCakes118.dll windows:4 windows x86 arch:x86
7537724ff4ce0371e8b06e630dd0a3ee
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExitProcess
GetModuleFileNameA
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
CloseHandle
UnmapViewOfFile
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
user32
SetWindowsHookExA
CharLowerA
CallNextHookEx
UnhookWindowsHookEx
shlwapi
StrStrA
Sections
.text Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
shellsha Size: - Virtual size: 4B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ