init_openssl
Static task
static1
Behavioral task
behavioral1
Sample
2b4efdd42d1248e162730976a361c89e_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2b4efdd42d1248e162730976a361c89e_JaffaCakes118.dll
Resource
win10v2004-20240426-en
General
-
Target
2b4efdd42d1248e162730976a361c89e_JaffaCakes118
-
Size
2.2MB
-
MD5
2b4efdd42d1248e162730976a361c89e
-
SHA1
80fd94939cb2d000635512a08186904a50f0e618
-
SHA256
a75e0459b5331c64153d7bf6c6929202f72845b806e958698515d80a19073995
-
SHA512
1acbbc5f98f02b2f20c764115a130abefc5b228cf3ca4ff7b0eac9121af64176615d48279975146cd9b5195e27ed597122eef20038f661f74bfb38095d5d5f32
-
SSDEEP
49152:0oWPNvEfZ9H0ueJ0xokREjYaCpkc1/YpduTrEnvRsw:GvEHH5exkREljc1/iuTr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b4efdd42d1248e162730976a361c89e_JaffaCakes118
Files
-
2b4efdd42d1248e162730976a361c89e_JaffaCakes118.dll windows:5 windows x86 arch:x86
7f5f6c0185b34f63f12d460cd08ebf21
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CryptEnumProvidersW
CryptDestroyKey
CryptGetProvParam
CryptAcquireContextW
CryptGetUserKey
CryptExportKey
CryptDestroyHash
CryptSignHashW
CryptSetHashParam
CryptCreateHash
CryptDecrypt
crypt32
CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertDuplicateCertificateContext
CertFreeCertificateContext
user32
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
ws2_32
setsockopt
getsockopt
WSAGetLastError
recvfrom
WSASetLastError
sendto
send
recv
closesocket
WSACleanup
python27
PyLong_FromVoidPtr
PyImport_ImportModule
_Py_NoneStruct
PyEval_RestoreThread
PyEval_SaveThread
PyInt_FromLong
PyErr_Occurred
PyArg_UnpackTuple
PyLong_FromUnsignedLong
PyFloat_AsDouble
PyLong_FromUnsignedLongLong
PyObject_CallMethod
msvcr90
_stricmp
atoi
memchr
strtoul
fwrite
perror
fclose
ferror
fread
fflush
_setmode
_fileno
ftell
feof
fseek
fgets
_strnicmp
_strdup
strerror_s
strcmp
_stat64i32
strrchr
isspace
strcspn
strspn
wcsstr
_vsnwprintf
_vsnprintf
_exit
raise
sscanf
_gmtime64_s
_wfopen
fopen
getenv
fprintf
__iob_func
strstr
fputs
signal
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_unlock
__dllonexit
_lock
_onexit
__clean_type_info_names_internal
_except_handler4_common
_crt_debugger_hook
strtol
malloc
qsort
memmove
strchr
_errno
strncmp
sprintf
_time64
memset
memcpy
strncpy
free
realloc
bcrypt
BCryptGenRandom
kernel32
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetTickCount
DisableThreadLibraryCalls
Sleep
InterlockedExchange
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
LoadLibraryW
CloseHandle
LoadLibraryA
FreeLibrary
ConvertThreadToFiber
ConvertFiberToThread
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStdHandle
GetFileType
WriteFile
GetVersion
GetModuleHandleW
GetProcAddress
GetEnvironmentVariableW
FindClose
MultiByteToWideChar
FindFirstFileW
FindNextFileW
WideCharToMultiByte
CreateFiber
SwitchToFiber
DeleteFiber
InterlockedExchangeAdd
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedCompareExchange
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleExW
GetSystemTime
SystemTimeToFileTime
SetLastError
GetLastError
Exports
Exports
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 426KB - Virtual size: 425KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 79KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ