Static task
static1
Behavioral task
behavioral1
Sample
2d9b6058fa6e89a62a5ed2f5fb0921f5_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2d9b6058fa6e89a62a5ed2f5fb0921f5_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
2d9b6058fa6e89a62a5ed2f5fb0921f5_JaffaCakes118
-
Size
33KB
-
MD5
2d9b6058fa6e89a62a5ed2f5fb0921f5
-
SHA1
3fa459c5591b45f12d60d5a510057ce955b09c04
-
SHA256
1561c50508dff9f421bad3261a0fb8009f506710f1f146db54fbf9f42bf70a1c
-
SHA512
57ceb0158745585e815c5837b1689cc35cb8d9262d43518fc7b59550da6c384027e513093b2454e3fe2e8bfbcd0b8b01e9935d9834c09ebce595cc5bb837a48a
-
SSDEEP
384:G0KdLROnPEPaix8359BWFuCsMSrxQ9pZqUH17g935nEnwrC1cP+6z6XwAlSArmP:GNDOnPEP/o5Ozs+hqUWdSn2mnpjrmP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d9b6058fa6e89a62a5ed2f5fb0921f5_JaffaCakes118
Files
-
2d9b6058fa6e89a62a5ed2f5fb0921f5_JaffaCakes118.dll windows:4 windows x86 arch:x86
ed3eb7c9a638dc7849b421417fb3b158
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcessId
Sleep
GetPrivateProfileStringA
GetModuleFileNameA
CreateThread
WideCharToMultiByte
ReadProcessMemory
GetProcAddress
LoadLibraryA
GetTempPathA
GetFileSize
ReadFile
CreateFileA
HeapAlloc
GetLastError
GetModuleHandleA
CloseHandle
VirtualProtect
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
InterlockedExchange
DeleteCriticalSection
msvcrt
wcscpy
wcsncat
wcslen
wcsstr
strncpy
malloc
_except_handler3
strchr
_vsnprintf
isspace
isalnum
wcscat
atoi
exit
__dllonexit
_onexit
_initterm
_adjust_fdiv
_strcmpi
free
_strlwr
strstr
strlen
mbstowcs
wcscmp
strrchr
strcpy
strcat
_stricmp
memcpy
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
gdiplus
GdipSaveImageToFile
GdipDisposeImage
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdiplusStartup
gdi32
DeleteDC
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
CreateDCA
DeleteObject
wsock32
closesocket
shutdown
user32
GetForegroundWindow
GetClassNameW
GetWindow
wsprintfA
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ