NSModule
Static task
static1
Behavioral task
behavioral1
Sample
f3a5d1484f32019a15fdc77a1247642e_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f3a5d1484f32019a15fdc77a1247642e_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f3a5d1484f32019a15fdc77a1247642e_JaffaCakes118
-
Size
228KB
-
MD5
f3a5d1484f32019a15fdc77a1247642e
-
SHA1
6007f4bff0efc5ad247bd43b358c42a67661c517
-
SHA256
6fadb2ab3615095b829b4b2f54dc295d7e0a9933a36e90a5b7140af4006fcda1
-
SHA512
437b76ec8c20edb4b8fc4b9105c1654fb87f23dce5a03600792d1c2e597a0d086085e77803c148437aecd0282d28b339f2f3a830fcdcd82a88fc872ff7e6ebf0
-
SSDEEP
3072:l/6rqJmvMZI6sg1WNwmwLiYR76Mv8ImtFGu3tB/CXIZZs/0utAXS:96rqwUf1v6V5frZjD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f3a5d1484f32019a15fdc77a1247642e_JaffaCakes118
Files
-
f3a5d1484f32019a15fdc77a1247642e_JaffaCakes118.dll windows:4 windows x86 arch:x86
6819c7c14d72dfef1a418c6ec9ffd783
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
xpcom
NS_CStringToUTF16
NS_CStringCloneData
NS_CStringCopy
NS_CStringContainerInit2
NS_GetServiceManager
NS_UTF16ToCString
NS_Free
NS_Realloc
NS_Alloc
NS_CStringGetMutableData
NS_GetComponentManager
NS_StringContainerInit2
NS_CStringGetData
NS_CStringContainerFinish
NS_CStringContainerInit
NS_CStringSetData
NS_StringSetDataRange
NS_CStringSetDataRange
NS_StringContainerInit
NS_StringSetData
NS_StringGetData
NS_StringCopy
NS_StringGetMutableData
NS_StringContainerFinish
kernel32
FlushFileBuffers
GetConsoleMode
GetConsoleCP
FreeLibrary
GetLocaleInfoW
LoadLibraryA
lstrcmpA
lstrlenA
VirtualQuery
FindResourceExW
FindResourceW
LoadResource
WideCharToMultiByte
SizeofResource
lstrcmpW
lstrlenW
LockResource
GetModuleFileNameA
GetFileSize
SetFilePointer
MapViewOfFile
lstrcpynA
SetEndOfFile
CreateDirectoryW
GlobalLock
SetFileTime
WriteFile
GetSystemDirectoryW
LoadLibraryW
GetVersionExW
GetFileAttributesW
ReadFile
WriteConsoleA
CreateFileW
MultiByteToWideChar
GlobalUnlock
OpenMutexW
GetLastError
GetProcAddress
FindClose
InterlockedExchangeAdd
CreateFileMappingW
lstrcmpiW
lstrcatW
FindNextFileW
GetFileTime
GetCurrentThreadId
CloseHandle
GetCurrentProcessId
lstrcpyW
lstrcpyA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetDateFormatA
GetTimeFormatA
ExitProcess
Sleep
GetTimeZoneInformation
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetModuleFileNameW
GetStdHandle
LCMapStringW
SetConsoleCtrlHandler
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
LCMapStringA
GetStringTypeA
VirtualAlloc
FatalAppExitA
SetStdHandle
GetTickCount
QueryPerformanceCounter
VirtualFree
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
DuplicateHandle
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetOEMCP
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
HeapCreate
user32
CloseClipboard
SetTimer
GetTopWindow
KillTimer
GetParent
wsprintfA
wsprintfW
GetKeyboardLayout
GetClassNameW
OpenClipboard
GetWindow
UnregisterClassA
advapi32
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
shell32
SHGetSpecialFolderPathW
nspr4
PR_sscanf
Exports
Exports
Sections
.text Size: 172KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ