___CPPdebugHook
Static task
static1
Behavioral task
behavioral1
Sample
0a44d6558b1ab06f51a8f3bd3eb6617d_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0a44d6558b1ab06f51a8f3bd3eb6617d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0a44d6558b1ab06f51a8f3bd3eb6617d_JaffaCakes118
-
Size
119KB
-
MD5
0a44d6558b1ab06f51a8f3bd3eb6617d
-
SHA1
173bbd58865c0d7ebbc79e0dd18cbd42128942fc
-
SHA256
b7d99cbaaa43d3a43726504ab24c402c38204a2f58cd10ba56bd56d830140ffa
-
SHA512
8b11826612eb3a333e13d6b6fb40d0755140aa29864c0849de3221994adad99a493816fc2ef51b6f7cb8d7f0fa3c0a02dfcba48840ed700a81c4b6786480c6f3
-
SSDEEP
3072:7pAVDNxrMYdKtiny+GAuYYhs6v4PDWMeT8H3NcQPrHXfX:ejxr3MtgvGANB6v4DWuOQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a44d6558b1ab06f51a8f3bd3eb6617d_JaffaCakes118
Files
-
0a44d6558b1ab06f51a8f3bd3eb6617d_JaffaCakes118.dll windows:4 windows x86 arch:x86
6a94224414c47b0e9a1ea0f89a09568c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CreateFileA
DeleteFileA
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsA
GetACP
GetCPInfo
GetCurrentThreadId
GetEnvironmentStrings
GetFileAttributesA
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDefaultLangID
GetUserDefaultLCID
GetVersion
GetVersionExA
GlobalMemoryStatus
HeapAlloc
HeapFree
IsDBCSLeadByteEx
IsValidLocale
LCMapStringA
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
RaiseException
ReadFile
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
SetLastError
SetThreadLocale
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WideCharToMultiByte
WriteFile
user32
EnumThreadWindows
MessageBoxA
wsprintfA
Exports
Exports
Sections
.text Size: 85KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ