?Dll2Main@@YGHPAUHINSTANCE__@@KPAX@Z
Static task
static1
Behavioral task
behavioral1
Sample
f98b746e2fe5a850226e754492cbe1af_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
f98b746e2fe5a850226e754492cbe1af_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f98b746e2fe5a850226e754492cbe1af_JaffaCakes118
-
Size
36KB
-
MD5
f98b746e2fe5a850226e754492cbe1af
-
SHA1
0f507e028d61f7db51291f11f5406192fa5ff0c8
-
SHA256
a9f5ea992bc4766c26e28fef50bb9f59732011125e0d37428da284ff826c5cad
-
SHA512
0539307bd53b1487ca836fb66b3afcde601bea1801fbe4c9570d905c8372389d23ab533d56fd7928a6f17cc54ea51a807b260473d2d432c6b87e3cbf715ff474
-
SSDEEP
384:AYwT095SRvCiib70PbaI0YGWTcGudh6kW/W/WAX:AYjXS9OGVGWwG4hoy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f98b746e2fe5a850226e754492cbe1af_JaffaCakes118
Files
-
f98b746e2fe5a850226e754492cbe1af_JaffaCakes118.dll windows:4 windows x86 arch:x86
89dbf06808eb5a46a730c5b76fc0caba
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
urlmon
URLDownloadToFileA
wininet
DeleteUrlCacheEntry
msvcrt
strlen
fopen
fseek
ftell
fgetc
fread
fclose
printf
srand
memcpy
memset
time
sprintf
strstr
rand
strcat
strcpy
kernel32
GetLastError
SetFileAttributesA
WritePrivateProfileStringA
LocalAlloc
lstrcmpiA
GetCurrentProcess
OpenProcess
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
CreateRemoteThread
GetVolumeInformationA
CopyFileA
Sleep
SetSystemTime
GetSystemTime
CloseHandle
GetFileSize
CreateFileA
DeleteFileA
WinExec
lstrcatA
GetSystemDirectoryA
CreateThread
lstrcpyA
lstrlenA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetComputerNameA
Process32Next
Process32First
CreateToolhelp32Snapshot
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
user32
CharUpperA
wsprintfA
advapi32
RegCloseKey
QueryServiceConfigA
ChangeServiceConfigA
OpenServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegEnumKeyA
RegOpenKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
shlwapi
StrCmpNIA
PathFileExistsA
Exports
Exports
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 640B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ