Static task
static1
Behavioral task
behavioral1
Sample
fd883cd1030576f55601d9ade57d823b_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
fd883cd1030576f55601d9ade57d823b_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
fd883cd1030576f55601d9ade57d823b_JaffaCakes118
-
Size
36KB
-
MD5
fd883cd1030576f55601d9ade57d823b
-
SHA1
902e67d3a574680fdc352295fdeb8d05c5b37f55
-
SHA256
ee4c2df12605331543f04418384eb91f094df64234e3bdf942c0feb4d1930d59
-
SHA512
2d9157d0b4bbd7c2dbe6ecba4cc38b37a1ea95b5eaa5c00c67005167a8cea53db4c7fec794d300ca2af40b7532caeb869f3702d93dc7358831530bc28aa7b66f
-
SSDEEP
384:mAZyuQ+1BvKFJN40e4m9ZeWfE+e80jsGU/r8A7e8QFPQhlSW+8jy5x3RM:mAZyuQ+1BvKFSfLfE9u8ke8QFPijS3R
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd883cd1030576f55601d9ade57d823b_JaffaCakes118
Files
-
fd883cd1030576f55601d9ade57d823b_JaffaCakes118.dll windows:4 windows x86 arch:x86
b446e7fe4101a5c1447c0d99b5f9edd1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord6648
ord4129
ord5710
ord926
ord924
ord922
ord537
ord2846
ord2764
ord2915
ord540
ord535
ord858
ord6663
ord860
ord4278
ord1168
ord800
ord2818
ord939
ord6877
msvcrt
_adjust_fdiv
malloc
_initterm
free
strstr
strncmp
strchr
strtok
exit
atoi
rand
srand
_mbscmp
printf
__CxxFrameHandler
time
kernel32
LoadLibraryA
GetProcAddress
Sleep
GetVersionExA
GlobalMemoryStatus
TerminateProcess
OpenProcess
ExitThread
CreateThread
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
ExitProcess
GetLastError
GetCurrentProcessId
HeapAlloc
GetProcessHeap
CloseHandle
TerminateThread
GetTickCount
CreateProcessA
CreateMutexA
GetSystemDirectoryA
user32
ExitWindowsEx
wsprintfA
advapi32
OpenServiceA
OpenSCManagerA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
DeleteService
urlmon
URLDownloadToFileA
ws2_32
inet_ntoa
htonl
gethostbyname
closesocket
connect
htons
inet_addr
socket
send
WSAGetLastError
recv
__WSAFDIsSet
select
WSAStartup
sendto
setsockopt
WSASocketA
gethostname
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 808B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ