_DllMain@12
Static task
static1
Behavioral task
behavioral1
Sample
edd0dff761ba5827e72be56163b2b9bc_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
edd0dff761ba5827e72be56163b2b9bc_JaffaCakes118.dll
Resource
win10v2004-20231215-en
General
-
Target
edd0dff761ba5827e72be56163b2b9bc_JaffaCakes118
-
Size
36KB
-
MD5
edd0dff761ba5827e72be56163b2b9bc
-
SHA1
4566487f1c8406bce9153085618212ea2d866386
-
SHA256
4ab805ce9d32bbc987033fd187e4795c9b18883b44301955d93e7ccb1750a862
-
SHA512
79f3ba55d4b1c4b19fd8f7e4adc3f3115ddbd6ad2749f56adb78d79f0db74b7b89fb91fef16f93b391f76a90465b697e5a9d3edb78bc3d30ed2035e2d30a1fb4
-
SSDEEP
384:eIuyXbv5MTOw+8X3fVRLWFpopwm0dhP3+yW/WzE:e0rvuFXHSpopwmChp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource edd0dff761ba5827e72be56163b2b9bc_JaffaCakes118
Files
-
edd0dff761ba5827e72be56163b2b9bc_JaffaCakes118.dll windows:4 windows x86 arch:x86
2abb0362f0709c6632e6e2f002dc443b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
urlmon
URLDownloadToFileA
wininet
DeleteUrlCacheEntry
ws2_32
connect
recv
closesocket
WSACleanup
htons
gethostbyname
socket
WSAStartup
send
msvcrt
atoi
rand
strncpy
strlen
fopen
fseek
ftell
fgetc
fread
fclose
memcpy
memset
time
sprintf
strstr
strcat
strcpy
kernel32
GetLastError
LocalAlloc
lstrcmpiA
GetCurrentProcess
OpenProcess
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
CreateRemoteThread
GetVolumeInformationA
Sleep
SetSystemTime
GetSystemTime
CloseHandle
GetFileSize
CreateFileA
DeleteFileA
WinExec
lstrcatA
GetSystemDirectoryA
CreateThread
lstrcpyA
lstrlenA
GetPrivateProfileStringA
GetPrivateProfileIntA
Process32Next
CreateToolhelp32Snapshot
WritePrivateProfileStringA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetComputerNameA
Process32First
user32
CharUpperA
wsprintfA
advapi32
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
QueryServiceConfigA
ChangeServiceConfigA
OpenServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumKeyA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateGuid
shlwapi
PathFileExistsA
Exports
Exports
Sections
.text Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 640B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ