Static task
static1
Behavioral task
behavioral1
Sample
0f9bf2ff15049bde8bd719424a32f022_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0f9bf2ff15049bde8bd719424a32f022_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
0f9bf2ff15049bde8bd719424a32f022_JaffaCakes118
-
Size
34KB
-
MD5
0f9bf2ff15049bde8bd719424a32f022
-
SHA1
f3bdbcb4e4fbc471c60d97a39f5ef46e5f6facac
-
SHA256
0294fd1ab4a6b162b8e818846f9cc88534fcb7d6e91679ca3f8da87770900726
-
SHA512
27c7dd77016c92ed82ed71664d9fb102ff9a2d6159f3c301f93983b493eaafc539b933ff5407a6e17bc1224171905e1e2fed50fd3b2a01031dc567d3d570467f
-
SSDEEP
768:78lmv1pDZjCUCcmQBzoPV39ve9kc+6nMVNMK3FW4RD9ietdZA:Ymv1pDZyrQBzs39vqkF62MKV3rA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f9bf2ff15049bde8bd719424a32f022_JaffaCakes118
Files
-
0f9bf2ff15049bde8bd719424a32f022_JaffaCakes118.dll windows:4 windows x86 arch:x86
c990fa018ea1b16afc0015fb89b659d0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord1158
ord924
ord858
ord535
ord2846
ord537
ord825
ord2764
ord6648
ord1168
ord4129
ord540
ord860
ord941
ord2915
ord800
ord823
msvcrt
_adjust_fdiv
_initterm
free
malloc
printf
strncmp
exit
strncpy
srand
time
rand
sprintf
strstr
strchr
atoi
__CxxFrameHandler
_strcmpi
kernel32
CreateEventA
OpenProcess
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
TerminateProcess
CloseHandle
WaitForSingleObject
Sleep
ExitThread
CreateProcessA
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateThread
lstrlenA
CreateRemoteThread
GetProcAddress
UnmapViewOfFile
CreateMutexA
CreateFileMappingA
GetLastError
MapViewOfFile
ReleaseMutex
GetCurrentProcess
GetVersionExA
GlobalMemoryStatus
GetSystemDirectoryA
WinExec
user32
wsprintfA
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSetValueExA
urlmon
URLDownloadToFileA
ws2_32
recv
closesocket
send
connect
inet_addr
WSAStartup
htons
WSAGetLastError
__WSAFDIsSet
select
gethostbyname
socket
winmm
timeGetTime
Sections
.text Size: - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.delete Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.pklstb Size: 27KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.relo2 Size: 512B - Virtual size: 150B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ