Behavioral task
behavioral1
Sample
2fb818d75629309d4368c3e2056a727d_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2fb818d75629309d4368c3e2056a727d_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
2fb818d75629309d4368c3e2056a727d_JaffaCakes118
-
Size
136KB
-
MD5
2fb818d75629309d4368c3e2056a727d
-
SHA1
e71338912910c1ecc5af837d445d250f5a6dc684
-
SHA256
bc794d69b4b15ef0b59620dc704ee0b9049936da0b397ff534e88b21d2a62b68
-
SHA512
4ae3fc9b24b4f8c23b0b0e41271e595c28313e54754636b1de74417cb668a134fca7a0f0165f312c18ef7e734b6a1cc675bff4d7a5f9f173991195b2b45ba7d9
-
SSDEEP
3072:r/8qkKp6X2sKrFS4+qPbLiWgizhtm4R4Yq:AqjGwFS4+qPVz6K4
Malware Config
Signatures
Files
-
2fb818d75629309d4368c3e2056a727d_JaffaCakes118.dll windows:4 windows x86 arch:x86
63332d92f44f9090d7de12d36e2a6b08
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
wininet
InternetReadFile
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
kernel32
GetVersionExA
GetSystemTime
GetFullPathNameA
LoadLibraryA
FlushFileBuffers
CopyFileA
DeleteFileA
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileA
GetSystemDirectoryA
LockResource
LoadResource
SizeofResource
FindResourceA
OutputDebugStringA
WriteProcessMemory
VirtualProtectEx
ReadProcessMemory
GetWindowsDirectoryA
WideCharToMultiByte
GetModuleFileNameA
Sleep
CreateThread
IsBadReadPtr
GetTickCount
GetTempPathA
GlobalFree
GlobalLock
GlobalAlloc
TerminateProcess
CreateEventA
OpenEventA
GetCommandLineA
GlobalUnlock
MultiByteToWideChar
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
DuplicateHandle
FreeLibrary
TerminateThread
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
VirtualAllocEx
lstrlenA
OpenProcess
SetEndOfFile
GetOEMCP
GetACP
IsBadCodePtr
SetUnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetStringTypeA
SetStdHandle
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleHandleA
CreateToolhelp32Snapshot
GetProcAddress
Process32First
Process32Next
GetCurrentProcess
CloseHandle
VirtualFree
VirtualAlloc
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchange
FindAtomA
RaiseException
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetTimeZoneInformation
GetLocalTime
InterlockedDecrement
InterlockedIncrement
RtlUnwind
GetVersion
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetLastError
InitializeCriticalSection
ExitProcess
HeapReAlloc
HeapAlloc
HeapSize
DeleteCriticalSection
LCMapStringA
LCMapStringW
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
user32
GetInputState
PostThreadMessageA
GetMessageA
DrawIconEx
FlashWindow
DrawMenuBar
GetDC
DestroyCursor
DestroyWindow
DrawIcon
EnableMenuItem
EnableScrollBar
EnableWindow
EndDialog
FindWindowA
FindWindowExA
GetCursor
GetDCEx
GetDesktopWindow
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
wsprintfA
DestroyMenu
gdi32
Ellipse
GetBkColor
advapi32
RegOpenKeyExA
RegCreateKeyExA
RegFlushKey
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueExA
shell32
SHGetFileInfoA
Sections
.text Size: 88KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ