NSModule
Static task
static1
Behavioral task
behavioral1
Sample
f20dba8d390107d743e13056bbdb84de_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f20dba8d390107d743e13056bbdb84de_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f20dba8d390107d743e13056bbdb84de_JaffaCakes118
-
Size
260KB
-
MD5
f20dba8d390107d743e13056bbdb84de
-
SHA1
ff611024917e8cb563ddd65ece38617edcd697f1
-
SHA256
776d166ce82be31379a4af12669f6e85fd6656ccaf0a72480e1abcc71de00eb5
-
SHA512
62e30d0033921603c6a5836fdb2adf12642e22d926b02e5427f3dc07cb5a91a25d8f64e00eba2673af8a0fffddb2448d7e5d18de6173197e52edbb283a5e25b2
-
SSDEEP
6144:1IFrcTc4YcvN+0OlzyzUVsb3h3jJAZ3g:1Iac45vCK3hyZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f20dba8d390107d743e13056bbdb84de_JaffaCakes118
Files
-
f20dba8d390107d743e13056bbdb84de_JaffaCakes118.dll windows:4 windows x86 arch:x86
54ac0b7785b51f0b885282d8ac2cfc0c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
xpcom
NS_CStringToUTF16
NS_CStringCloneData
NS_CStringCopy
NS_CStringContainerInit2
NS_GetServiceManager
NS_UTF16ToCString
NS_Free
NS_Realloc
NS_Alloc
NS_CStringGetMutableData
NS_GetComponentManager
NS_StringContainerInit2
NS_CStringGetData
NS_CStringContainerFinish
NS_CStringContainerInit
NS_CStringSetData
NS_StringSetDataRange
NS_CStringSetDataRange
NS_StringContainerInit
NS_StringSetData
NS_StringGetData
NS_StringCopy
NS_StringGetMutableData
NS_StringContainerFinish
kernel32
FlushFileBuffers
GetConsoleMode
GetConsoleCP
FreeLibrary
GetLocaleInfoW
LoadLibraryA
lstrcmpA
lstrlenA
VirtualQuery
FindResourceExW
FindResourceW
LoadResource
WideCharToMultiByte
SizeofResource
lstrcmpW
lstrlenW
LockResource
GetModuleFileNameA
GetFileSize
SetFilePointer
MapViewOfFile
lstrcpynA
SetEndOfFile
GlobalLock
SetFileTime
WriteFile
GetSystemDirectoryW
LoadLibraryW
GetVersionExW
GetFileAttributesW
ReadFile
GetModuleFileNameW
WriteConsoleA
MultiByteToWideChar
GlobalUnlock
OpenMutexW
GetLastError
GetProcAddress
FindClose
GetLocalTime
InterlockedExchangeAdd
CreateFileMappingW
lstrcmpiW
lstrcatW
FindNextFileW
GetFileTime
GetCurrentThreadId
CloseHandle
GetCurrentProcessId
lstrcpyW
lstrcpyA
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetDateFormatA
GetTimeFormatA
ExitProcess
Sleep
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
CreateFileW
GetTimeZoneInformation
GetStdHandle
SetConsoleCtrlHandler
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
LCMapStringW
GetStringTypeA
VirtualAlloc
FatalAppExitA
SetStdHandle
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
DuplicateHandle
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetOEMCP
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
LCMapStringA
VirtualFree
user32
CloseClipboard
SetTimer
GetTopWindow
KillTimer
GetParent
wsprintfA
wsprintfW
GetKeyboardLayout
GetClassNameW
OpenClipboard
GetWindow
UnregisterClassA
advapi32
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
shell32
SHGetSpecialFolderPathW
nspr4
PR_sscanf
Exports
Exports
Sections
.text Size: 204KB - Virtual size: 202KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ