Init
Static task
static1
Behavioral task
behavioral1
Sample
f75360ddfaeecc16ba17ac670e98215d_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f75360ddfaeecc16ba17ac670e98215d_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f75360ddfaeecc16ba17ac670e98215d_JaffaCakes118
-
Size
111KB
-
MD5
f75360ddfaeecc16ba17ac670e98215d
-
SHA1
f7fd897f7ce865c3af5413dbeccdce926ed9def8
-
SHA256
2c335ff053926d754d62304a7b5012b8d7e8f704907b236fac045d7717e185ca
-
SHA512
a1f721bb4e8515c26499a9326e757df9c07470d9f7e29cf636b67c529a370f9fb73c382f40451857c570da88ed96fcc52f39f65676d963927b409979844288a5
-
SSDEEP
3072:JG93SLvzGD+POo66OXVUaGPM9XWrz4HQtRDFXHKY625C1yisL:A93SLvzBaGPM9GrsonqY625+aL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f75360ddfaeecc16ba17ac670e98215d_JaffaCakes118
Files
-
f75360ddfaeecc16ba17ac670e98215d_JaffaCakes118.dll windows:5 windows x86 arch:x86
c55f4d38d2756160ccf4a5df0008d26d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
connect
htons
recv
__WSAFDIsSet
shutdown
WSAGetLastError
select
ioctlsocket
gethostbyname
send
socket
closesocket
WSAStartup
psapi
EnumProcessModules
GetModuleBaseNameA
EnumProcesses
crypt32
CryptBinaryToStringA
CryptStringToBinaryA
kernel32
GetTempFileNameA
LoadLibraryA
GetVersionExA
CloseHandle
GetTempPathA
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
MoveFileExA
GetModuleFileNameA
WriteFile
GetTickCount
lstrcmpA
lstrcpynA
CreateEventA
GetFileAttributesA
GetEnvironmentVariableA
FindFirstFileA
GetLastError
CopyFileA
FreeLibrary
GetProcAddress
OpenEventA
FindNextFileA
CreateRemoteThread
VirtualAllocEx
GetCurrentProcessId
WriteProcessMemory
WaitForSingleObject
SetEvent
CreateEventW
GetComputerNameExA
ResetEvent
WaitForMultipleObjects
GetLocalTime
CreateFileA
lstrcpyA
lstrcmpiA
lstrcatA
EnterCriticalSection
LeaveCriticalSection
lstrlenA
IsBadWritePtr
CreateProcessA
Sleep
OpenProcess
FindClose
InitializeCriticalSection
CreateThread
SetFileAttributesA
advapi32
RegCreateKeyA
RegSetValueExA
RegQueryValueExA
CryptHashData
CryptDestroyHash
RegOpenKeyA
RegEnumValueA
RegQueryInfoKeyA
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegCloseKey
CryptDecrypt
CryptDestroyKey
CryptGenKey
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptAcquireContextW
CryptExportKey
CryptGetHashParam
RegEnumKeyA
RegCreateKeyExA
dnsapi
DnsQuery_A
DnsFree
wininet
InternetTimeFromSystemTimeA
Exports
Exports
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ