Static task
static1
Behavioral task
behavioral1
Sample
3b7bc0ba22c4d18096d70ddafd0f58b2_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3b7bc0ba22c4d18096d70ddafd0f58b2_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
3b7bc0ba22c4d18096d70ddafd0f58b2_JaffaCakes118
-
Size
17KB
-
MD5
3b7bc0ba22c4d18096d70ddafd0f58b2
-
SHA1
d1ce2a88a137f1b62a8b5ade52d42b3b16f55881
-
SHA256
e8ddbf552e14a57a8e1f18affbe61d2f7c5789a7435a900ad7d0c4d30aa3a519
-
SHA512
782f1b30de68d0231bc453f43ae101d19ca2d8b31b3a2fe5d64ae15c0918b85a6af25f76095a51706dd0cce77a8b124059865a3c57f627512b7e8918e6093459
-
SSDEEP
384:l8w9eUQcbKchTWX518NXR8QEQ12XISNeh:lnBQeKcFTNBREQ1jSNe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3b7bc0ba22c4d18096d70ddafd0f58b2_JaffaCakes118
Files
-
3b7bc0ba22c4d18096d70ddafd0f58b2_JaffaCakes118.dll windows:4 windows x86 arch:x86
c98c5fcc3b9781a035766101d95b7b20
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DeleteFileA
CreateFileA
WriteFile
OpenEventA
Sleep
GetFileSize
ReadFile
GetModuleFileNameA
VirtualProtectEx
ReadProcessMemory
GetCurrentProcess
GetModuleHandleA
CopyFileA
CreateEventA
SetThreadPriority
CreateThread
GlobalLock
GlobalAlloc
IsBadReadPtr
GetCurrentProcessId
ExitProcess
GetProcAddress
OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
VirtualAlloc
CreateRemoteThread
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
VirtualFree
OutputDebugStringA
user32
ClientToScreen
GetClientRect
ToAscii
MapVirtualKeyA
GetKeyboardState
GetKeyState
EnumChildWindows
SendMessageA
GetForegroundWindow
GetClassNameA
IsWindowEnabled
IsWindowVisible
GetWindowThreadProcessId
GetWindowTextA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetDC
ReleaseDC
CheckDlgButton
CheckMenuItem
CheckMenuRadioItem
DestroyWindow
DeleteMenu
DestroyCursor
DestroyMenu
wsprintfA
GetInputState
PostThreadMessageA
GetMessageA
DestroyIcon
gdi32
BitBlt
CancelDC
GetPixel
DeleteObject
advapi32
RegQueryValueExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
wininet
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ