Static task
static1
Behavioral task
behavioral1
Sample
06582f26ea2bd03ee6385c72c5ff8a14_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
06582f26ea2bd03ee6385c72c5ff8a14_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
06582f26ea2bd03ee6385c72c5ff8a14_JaffaCakes118
-
Size
31KB
-
MD5
06582f26ea2bd03ee6385c72c5ff8a14
-
SHA1
bbbe5c95bd9889b95928f8fb04641b47c33b0e58
-
SHA256
ac2dee8fc19df146cece539065b7e5d5cfb758277a8b3e0ca860401dd4eeca0b
-
SHA512
2744ddcd8e6e6897b37082bb73e0f3bbc1b5b9ba4354362188b4a2ae67b5a28cf60a79d3e680a7f2010da1ba4a8c776d978ba8e70d58993c85e2b3df4277b6ce
-
SSDEEP
768:/mLI1JsA7TWddbLoAwfMqUMY9gpyxasa+pB:/EuHWddbLCU3gpyxas5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 06582f26ea2bd03ee6385c72c5ff8a14_JaffaCakes118
Files
-
06582f26ea2bd03ee6385c72c5ff8a14_JaffaCakes118.dll windows:4 windows x86 arch:x86
b7b46ebe93931e1ae7460205e3e2e46a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcessId
Sleep
CreateThread
lstrlenA
GetPrivateProfileStringA
WideCharToMultiByte
ReadProcessMemory
GetProcAddress
LoadLibraryA
GetTempPathA
SetThreadPriority
GetFileSize
ReadFile
CreateFileA
HeapAlloc
GetModuleFileNameA
GetLastError
GetModuleHandleA
CloseHandle
VirtualProtect
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
InterlockedExchange
DeleteCriticalSection
msvcrt
wcscpy
wcsncat
wcslen
wcsstr
strrchr
_stricmp
malloc
_except_handler3
strchr
_vsnprintf
isspace
isalnum
wcscat
atoi
exit
__dllonexit
_onexit
_initterm
_adjust_fdiv
_strcmpi
free
_strlwr
mbstowcs
wcscmp
sprintf
strncpy
strlen
strstr
strcpy
strcat
memcpy
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
gdiplus
GdipSaveImageToFile
GdipDisposeImage
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdiplusStartup
gdi32
DeleteDC
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
CreateDCA
DeleteObject
wsock32
closesocket
shutdown
user32
GetClassNameW
GetWindow
wsprintfA
GetForegroundWindow
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ