DllMain@12
Static task
static1
Behavioral task
behavioral1
Sample
f10f21b303ad849e7540c430c29f86d2_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f10f21b303ad849e7540c430c29f86d2_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f10f21b303ad849e7540c430c29f86d2_JaffaCakes118
-
Size
41KB
-
MD5
f10f21b303ad849e7540c430c29f86d2
-
SHA1
69c3634b54e9d62a04f85c852c435ea4f809061c
-
SHA256
cb5bf7dd46f24f5f92d1ba3e264ba0dc005d32b77f802dbed2b99977730978cd
-
SHA512
92d9e78735579c066aed5d129089c602991c3cc2d7c5ef41a4f0fc56fef50ebf1a7ae6d55a4ab42494a7a4a537e90cd4a0c69687fb746690c1721cff9bd8ee5a
-
SSDEEP
768:4hKYY4ejENQo//mTCXhbanF0Nd/QbnGrL2dEEPAdmOc:4xY4GEGo//+7ncdIbnGrL6EEPAdq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f10f21b303ad849e7540c430c29f86d2_JaffaCakes118
Files
-
f10f21b303ad849e7540c430c29f86d2_JaffaCakes118.dll windows:4 windows x86 arch:x86
70617d9e3f5551120fe800f371191069
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
ws2_32
WSACleanup
WSAGetOverlappedResult
WSARecv
WSASend
WSAStartup
closesocket
connect
gethostbyname
htons
socket
advapi32
ChangeServiceConfig2A
CloseServiceHandle
ControlService
CreateServiceA
DeleteService
EnumServicesStatusA
OpenSCManagerA
OpenServiceA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
StartServiceA
kernel32
AddAtomA
CloseHandle
CreateDirectoryA
CreatePipe
CreateProcessA
CreateSemaphoreA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
FindAtomA
FindClose
FindFirstFileA
FindNextFileA
GetAtomNameA
GetComputerNameA
GetDiskFreeSpaceExA
GetDriveTypeA
GetFileSize
GetLastError
GetLogicalDriveStringsA
GetModuleFileNameA
GetSystemDirectoryA
GetVersionExA
InterlockedDecrement
InterlockedIncrement
Module32First
OpenFile
OpenProcess
PeekNamedPipe
Process32First
Process32Next
ReadFile
ReleaseSemaphore
RemoveDirectoryA
SetFilePointer
SetLastError
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
WriteFile
lstrcatA
lstrcpyA
lstrlenA
msvcrt
_strlwr
__dllonexit
_errno
_iob
abort
fflush
fprintf
free
malloc
memcpy
memset
strcmp
strncmp
shell32
ShellExecuteA
user32
EnumWindows
GetWindowTextA
GetWindowThreadProcessId
IsWindowVisible
MessageBoxA
Exports
Exports
Sections
.text Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 16KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 788B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ