Static task
static1
Behavioral task
behavioral1
Sample
4082b3a7a6fff94d73a60a7b84e9b2cd_JaffaCakes118.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
4082b3a7a6fff94d73a60a7b84e9b2cd_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
4082b3a7a6fff94d73a60a7b84e9b2cd_JaffaCakes118
-
Size
19KB
-
MD5
4082b3a7a6fff94d73a60a7b84e9b2cd
-
SHA1
355e54fcaca7a833d30ff98d6440bc208c881e22
-
SHA256
ed5ee76d07242026e1118f51ecd022b073a954cbad33aec36ce544ff638c55dd
-
SHA512
7fa5f4b5bcb430f2ad48b47a8b5565526ff5fbeff1be5f11cd17bc213fe1ff00f1a26b9a7501c1878ad6224ee5953c55d7b357bf0d74279df0f34eda6d75464d
-
SSDEEP
384:6jqad4aWfus2Hfoq9N3xKff5ADl6yL2uOu3q+ckOg6h8:SWfuPfoQNBa5ADlbOuaCOga8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4082b3a7a6fff94d73a60a7b84e9b2cd_JaffaCakes118
Files
-
4082b3a7a6fff94d73a60a7b84e9b2cd_JaffaCakes118.dll windows:4 windows x86 arch:x86
f4df260d4e8867649d668152980d54cd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalUnlock
GlobalLock
GlobalAlloc
Thread32Next
GetThreadPriority
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetPrivateProfileStringA
IsBadReadPtr
ExitProcess
LeaveCriticalSection
EnterCriticalSection
GetCurrentThread
TerminateProcess
InitializeCriticalSection
VirtualProtect
GetModuleHandleA
GlobalFree
RaiseException
WideCharToMultiByte
LoadLibraryA
ReadProcessMemory
SetThreadContext
SetUnhandledExceptionFilter
WriteProcessMemory
Sleep
SetThreadPriority
WaitForSingleObject
CloseHandle
GetCurrentProcess
GetCurrentThreadId
VirtualProtectEx
GetModuleFileNameA
CreateThread
TerminateThread
GetCurrentProcessId
CreateMutexA
GetProcAddress
GetLastError
user32
GetWindowThreadProcessId
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetWindowTextA
GetForegroundWindow
FindWindowA
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
msvcrt
free
_initterm
malloc
_stricmp
_adjust_fdiv
_strlwr
fopen
fread
fclose
strstr
strcat
sprintf
strcpy
memcpy
strrchr
memset
strlen
??2@YAPAXI@Z
strcmp
wcslen
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 153B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ