Static task
static1
Behavioral task
behavioral1
Sample
277bbb627d9a4c64591839a991be0d6b_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
277bbb627d9a4c64591839a991be0d6b_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
277bbb627d9a4c64591839a991be0d6b_JaffaCakes118
-
Size
16KB
-
MD5
277bbb627d9a4c64591839a991be0d6b
-
SHA1
22e36f419be2e38a5d1ffc01e07c8e5641aa9365
-
SHA256
1ae3ac87d7c7ec325c6da9d6570d8658147a2a5e27191f515607678cf8e2a79c
-
SHA512
fa220f37905e79cac16d328fd73cc703ccc49d61ce4ad908249cb25f4547bb2e4d789558bb6103d51fe14f8225fcb8f7f5eb0fceec5f4e117496b1c508eb9975
-
SSDEEP
192:+hz2iVQ3yot7FW3ZLsqtyDAykViqmlIG6/S5veYvot4JSJtztGR3QSkN7TMzvGSS:+hz2ieRWpLjteqbS5vewothD58GSS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 277bbb627d9a4c64591839a991be0d6b_JaffaCakes118
Files
-
277bbb627d9a4c64591839a991be0d6b_JaffaCakes118.dll windows:4 windows x86 arch:x86
d2241303a2aa14b76d049099eefb0927
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetTickCount
Sleep
HeapAlloc
GetProcessHeap
VirtualProtect
CloseHandle
WriteFile
SetFilePointer
CreateFileA
CompareStringA
IsBadReadPtr
GetCurrentProcess
OpenProcess
GetCurrentProcessId
GetLastError
CreateMutexA
OpenMutexA
LoadLibraryA
GetModuleHandleA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetProcAddress
lstrlenA
CreateThread
DeleteFileA
ReadFile
GetFileSize
GetModuleFileNameA
GetSystemDirectoryA
FreeLibrary
user32
wsprintfA
GetWindowThreadProcessId
FindWindowA
SetTimer
KillTimer
TranslateMessage
DispatchMessageA
GetMessageA
GetDesktopWindow
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
wininet
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA
shlwapi
PathFileExistsA
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ