Static task
static1
Behavioral task
behavioral1
Sample
27c8449b0519bcd34e08586fb2856724_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
27c8449b0519bcd34e08586fb2856724_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
27c8449b0519bcd34e08586fb2856724_JaffaCakes118
-
Size
277KB
-
MD5
27c8449b0519bcd34e08586fb2856724
-
SHA1
91021e053088ef92a00de036c2eabec855e56594
-
SHA256
f5fe6662f02589d1b07dc3d5ecc3ec31ea6fdb7de531eab8248fa6b974e8f55c
-
SHA512
fe268b8c3e2b2921915be9a1e319a7220c41dc9f1efaa63e01adde70c31d0a68b0e06e6f6d8084638fafec63906c28329983a1eb62b4dac49b88735cfc59a190
-
SSDEEP
6144:bxW0KmxJkyF38G+SKCYSWdMzZScahC+x/6G+Lubma7hA:bR9JkQ38SK1SW085C+RZm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 27c8449b0519bcd34e08586fb2856724_JaffaCakes118
Files
-
27c8449b0519bcd34e08586fb2856724_JaffaCakes118.dll windows:4 windows x86 arch:x86
2d688c71bd2681311d8e704cabb9c687
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
comdlg32
GetSaveFileNameA
ChooseColorA
GetOpenFileNameA
shlwapi
SHQueryValueExA
SHGetValueA
SHSetValueA
SHQueryInfoKeyA
oleaut32
SysReAllocStringLen
VariantChangeType
VariantCopyInd
SysFreeString
SafeArrayGetUBound
OleLoadPicture
SysAllocStringLen
msvcrt
time
user32
UnhookWindowsHookEx
DestroyCursor
GetSystemMetrics
ChildWindowFromPoint
EnumChildWindows
SetWindowPos
SetWindowTextA
GetMenuStringA
CharToOemA
SetRect
MoveWindow
RegisterClipboardFormatA
GetDC
GetKeyboardLayout
PostQuitMessage
BeginPaint
MapVirtualKeyA
GetKeyboardState
CreateIcon
GetActiveWindow
GetMenuState
kernel32
GetCommandLineW
LoadLibraryExA
GetProcAddress
LoadLibraryA
GetCommandLineA
GetModuleFileNameA
WideCharToMultiByte
GetModuleHandleA
VirtualAlloc
HeapAlloc
GetProcessHeap
GetLastError
ExitThread
GetTickCount
GetOEMCP
ExitProcess
GetCurrentThreadId
EnterCriticalSection
Sections
CODE Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 421B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
BSS Size: 169KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ