Static task
static1
Behavioral task
behavioral1
Sample
166a6705d972e05556d1950ee9d3ff4a_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
166a6705d972e05556d1950ee9d3ff4a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
166a6705d972e05556d1950ee9d3ff4a_JaffaCakes118
-
Size
40KB
-
MD5
166a6705d972e05556d1950ee9d3ff4a
-
SHA1
0a25577dd1182150375f4facce1f79a7ef70078d
-
SHA256
8453cbdcaf5c5c49e3d0f021c102207329c941981117397a7d6baf2ba1e95d2b
-
SHA512
d6d6b22432aaeab950732c2ab36722d9586be3ae0a9a3056af4239ad5ef49f2fae88818f3eb4e30a5d8b1c8deab2d0a7cda5bb16a1b229d089adec63502c2a84
-
SSDEEP
768:ImiSS68zq9QXbrwA3GeBKY05f7AyeO9NBBQARQk7sXdz:ITSSCaUfcyeO9NBBQARL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 166a6705d972e05556d1950ee9d3ff4a_JaffaCakes118
Files
-
166a6705d972e05556d1950ee9d3ff4a_JaffaCakes118.dll windows:4 windows x86 arch:x86
2ea55118d8c1de2a2d334149c13d2baf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
_snprintf
strstr
RtlZeroMemory
RtlUnwind
memcmp
memcpy
strlen
kernel32
GetExitCodeThread
IsBadReadPtr
lstrcpynA
WriteFile
WideCharToMultiByte
VirtualProtectEx
VirtualFree
VirtualAlloc
UnmapViewOfFile
CloseHandle
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
InitializeCriticalSection
LeaveCriticalSection
Sleep
TerminateThread
WaitForSingleObject
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrlenA
CreateFileA
CreateFileMappingA
CreateProcessA
DeleteFileA
ReadFile
GetFileSize
GetLastError
GetStartupInfoA
GetSystemDirectoryA
GetTempFileNameA
GetTempPathA
LoadLibraryA
MapViewOfFile
MoveFileExA
user32
wsprintfA
UnhookWindowsHookEx
SetTimer
SendMessageA
RegisterWindowMessageA
KillTimer
PostMessageA
GetWindowThreadProcessId
GetWindowTextA
EnumWindows
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 12B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 682B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ