Static task
static1
Behavioral task
behavioral1
Sample
36bd8e0fe6b77be714e6777d246f945b_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
36bd8e0fe6b77be714e6777d246f945b_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
36bd8e0fe6b77be714e6777d246f945b_JaffaCakes118
-
Size
185KB
-
MD5
36bd8e0fe6b77be714e6777d246f945b
-
SHA1
cfd1af1c8853ccc84cc6a47001a3dedab3826080
-
SHA256
742bdc72d2aec8b71ed5eca86f24b45378286f769b4e51ce4e3d8637d0759664
-
SHA512
f86474c30ae14b0f290923b56cca1337a801540b739a68f1bad816dace2d67d97d8b543ef2626433a4217ab39f8c6f1c522383426f82c446764d670600a95e20
-
SSDEEP
3072:2+JioCkOsYeOzm4CwFNQir+pH+Mjh4HeWfsEtCMu3aDO:2+JrOsWCwMirgjh4HeW0+O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36bd8e0fe6b77be714e6777d246f945b_JaffaCakes118
Files
-
36bd8e0fe6b77be714e6777d246f945b_JaffaCakes118.dll windows:5 windows x86 arch:x86
3ec7783e307996a7d966eb521f65d62b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleW
QueryPerformanceCounter
VirtualAlloc
GetProcAddress
ReadFile
GetModuleFileNameW
CloseHandle
GetCurrentThreadId
GetCurrentProcess
GetCommandLineW
ExitProcess
CreateProcessW
GetStartupInfoA
user32
GetScrollRange
DrawTextA
gdi32
SetBkColor
TranslateCharsetInfo
TextOutA
SetWindowOrgEx
SetWindowExtEx
CloseMetaFile
CopyMetaFileA
CreateFontIndirectA
CreateMetaFileA
DeleteObject
GetDeviceCaps
SetTextColor
GetStockObject
GetTextExtentPoint32A
PatBlt
SelectObject
GetLayout
SetBkMode
SetLayout
SetTextAlign
comdlg32
GetOpenFileNameA
GetSaveFileNameA
advapi32
RegQueryValueA
RegOpenKeyExA
RegOpenKeyA
RegEnumKeyA
RegCloseKey
RegSetValueA
RegQueryValueExA
shell32
DragFinish
DragAcceptFiles
DragQueryFileA
ShellExecuteExA
ShellAboutA
ExtractAssociatedIconA
wininet
CreateUrlCacheEntryA
DeleteUrlCacheEntry
CommitUrlCacheEntryA
msvcrt
_XcptFilter
__getmainargs
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_acmdln
_adjust_fdiv
_c_exit
_cexit
_controlfp
_except_handler3
_exit
_initterm
_vsnprintf
exit
memmove
strchr
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data3 Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data2 Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 852B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ