wndplt
Static task
static1
Behavioral task
behavioral1
Sample
4271bac80a7d221930f31ac27a587e17_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4271bac80a7d221930f31ac27a587e17_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
4271bac80a7d221930f31ac27a587e17_JaffaCakes118
-
Size
12KB
-
MD5
4271bac80a7d221930f31ac27a587e17
-
SHA1
cacad3da7814d212071f8f7b4cf40f363058c14f
-
SHA256
d9a9ce4a804ca732064ea97bc37220c8c72b5c50672ca8353f355820c7edfcd2
-
SHA512
897c340463cc7aad64ed7633fc4d5985a382e8cfcd3405c241f563a2c34daa01183c716d5359b0d0e5fe06dec92f11360c2ca94bb2cca176079f9fe8f16142a0
-
SSDEEP
192:O/e6vzFR9gQMv/lUnuOfj1AX3RajSc/Ic9kuL7IHYd7i:p6vprKXiuSja1cgcmbEi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4271bac80a7d221930f31ac27a587e17_JaffaCakes118
Files
-
4271bac80a7d221930f31ac27a587e17_JaffaCakes118.dll windows:4 windows x86 arch:x86
3edf6dc606e7ee5cd8555e4d7535f81a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
ReplyMessage
CallWindowProcW
wsprintfA
GetInputDesktop
GetAltTabInfoA
AnimateWindow
RegisterClassExW
kernel32
lstrlenA
CloseHandle
ExitProcess
ExitThread
FlushViewOfFile
GetProcessHeaps
GetSystemTime
GetTickCount
LoadLibraryA
LoadLibraryExA
OpenFile
lstrcmpiA
RtlMoveMemory
OpenMutexA
SetSystemPowerState
Sleep
SystemTimeToFileTime
WriteFileEx
lstrcatA
advapi32
GetFileSecurityA
GetSecurityInfo
GetMultipleTrusteeOperationA
GetMultipleTrusteeA
GetLengthSid
gdi32
GetROP2
GetWindowOrgEx
GetPolyFillMode
GetPixelFormat
GetPixel
GetPath
GetPaletteEntries
RealizePalette
ws2_32
socket
setsockopt
recv
connect
ntdll
RtlGetAce
RtlFreeHeap
RtlFreeHandle
RtlFormatMessage
NtPulseEvent
NtCreateTimer
NtCreateNamedPipeFile
NtCreateEvent
NtCancelTimer
NtCancelIoFile
NtCallbackReturn
Exports
Exports
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 946B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ