_DllMain@12
Static task
static1
Behavioral task
behavioral1
Sample
f5b1b2b5f9e2a0e5d791831428b002c3_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f5b1b2b5f9e2a0e5d791831428b002c3_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f5b1b2b5f9e2a0e5d791831428b002c3_JaffaCakes118
-
Size
340KB
-
MD5
f5b1b2b5f9e2a0e5d791831428b002c3
-
SHA1
861cd0b0051060bd31684d0075ca5a8312e1c1a8
-
SHA256
39c95aecdf6577329f455955f90ba449709c9e368f6dfc7b4c4cb459fb28396c
-
SHA512
552d1c0f7569060fc777aa9d8b065e542931c138318dec0102e54acb952f1017248828119a20148d24363b01d55e3146f723e8703c89b430a9d8d4a69b735717
-
SSDEEP
6144:36Zo/XycuZMxTEky3v+RLQ9AfMKW0CHrIdLhH66Su6invl6V:3Co/Xycuay3W69KWj6LhH6tu796V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f5b1b2b5f9e2a0e5d791831428b002c3_JaffaCakes118
Files
-
f5b1b2b5f9e2a0e5d791831428b002c3_JaffaCakes118.dll windows:4 windows x86 arch:x86
2a08a2bdf5f76f967018ba08e0381f80
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
CloseHandle
UnmapViewOfFile
VirtualAlloc
GetProcAddress
GetModuleHandleA
WaitForSingleObject
ReadFile
CreateFileW
FindClose
FindFirstFileW
WriteFile
GetCurrentProcess
GetModuleHandleW
GlobalMemoryStatusEx
DeleteFileW
GetPrivateProfileIntW
lstrcatW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetModuleFileNameW
GetTickCount
Sleep
TerminateThread
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetPrivateProfileStringW
TerminateProcess
GetExitCodeProcess
OpenProcess
ReadProcessMemory
VirtualQuery
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetProcessTimes
ExitProcess
GetFileType
SetEvent
CreateEventW
SetEndOfFile
CreateFileA
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetLastError
HeapFree
GetSystemTimeAsFileTime
ExitThread
ResumeThread
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapAlloc
GetProcessHeap
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeA
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetStdHandle
GetStartupInfoA
SetFilePointer
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
user32
MessageBoxW
GetWindowThreadProcessId
GetClassNameW
GetWindowTextW
EnumWindows
shell32
ShellExecuteW
ws2_32
recv
closesocket
send
htons
socket
gethostbyname
inet_addr
connect
psapi
GetProcessImageFileNameW
GetModuleBaseNameW
GetModuleInformation
dbghelp
EnumerateLoadedModules
Exports
Exports
Sections
.text Size: 264KB - Virtual size: 261KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ