Fire
Static task
static1
Behavioral task
behavioral1
Sample
0fcea457721d9950dc3db42b6afed8b9_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0fcea457721d9950dc3db42b6afed8b9_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0fcea457721d9950dc3db42b6afed8b9_JaffaCakes118
-
Size
64KB
-
MD5
0fcea457721d9950dc3db42b6afed8b9
-
SHA1
abcbf7331e0a4b403b2d2f209d368ccfcd94655c
-
SHA256
b1a139e95ec70b9bc7e1c7b66c41fba8595cb1744a133d406f60df9b145fe479
-
SHA512
54031f3351568aac5d9af8f40c06b9520e23b5e5de0912176591f71aeba70b9e68d39cdef047ef6646b270cd2cc29f1082250067f7bfd781ddcf2e0296cd0ad6
-
SSDEEP
1536:c6lELlpUdBqkVmSqbHSTK1fhXkvXSg/hnZsBU7:RqRhtkfSg/hn2S
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0fcea457721d9950dc3db42b6afed8b9_JaffaCakes118
Files
-
0fcea457721d9950dc3db42b6afed8b9_JaffaCakes118.dll windows:4 windows x86 arch:x86
ce261b11659d79b63fb27de47820ff68
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
printf
longjmp
_setjmp3
_itoa
free
memmove
_purecall
strncmp
atoi
strncpy
strcmp
_strcmpi
isdigit
_strdup
sscanf
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_strlwr
memset
memcpy
memcmp
strchr
sprintf
strstr
strncat
strlen
malloc
strcpy
strcat
??1type_info@@UAE@XZ
_CxxThrowException
strspn
strcspn
tolower
isxdigit
isupper
isspace
ispunct
isprint
islower
isgraph
iscntrl
isalpha
isalnum
advapi32
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptGetUserKey
CryptDeriveKey
CryptGenKey
kernel32
GetComputerNameA
UnmapViewOfFile
lstrcpynA
CreateFileMappingA
MapViewOfFile
lstrcmpiA
GetWindowsDirectoryA
CreateFileA
GetFileSize
ReadFile
SetFilePointer
CreateMutexA
WaitForSingleObject
ReleaseMutex
FlushViewOfFile
Sleep
GetCurrentProcess
VirtualProtect
FlushInstructionCache
LocalFree
GetVersionExA
GetVolumeInformationA
FreeLibrary
VirtualQuery
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetLastError
GetTickCount
TlsSetValue
TlsGetValue
lstrlenA
GetCurrentProcessId
TlsAlloc
GetProcAddress
LoadLibraryA
TlsFree
GetModuleHandleA
GetModuleFileNameA
CreateThread
CreateEventA
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
TerminateThread
WaitForMultipleObjects
SetEvent
lstrcpyA
SetEndOfFile
WriteFile
MultiByteToWideChar
user32
CallNextHookEx
EnumWindows
UpdateWindow
BringWindowToTop
SetForegroundWindow
CharLowerA
FindWindowA
SendMessageA
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowTextA
ws2_32
send
recv
closesocket
WSARecv
connect
WSAGetLastError
ntohs
getpeername
WSASend
inet_ntoa
ole32
CoCreateInstance
OleUninitialize
OleInitialize
wininet
HttpOpenRequestA
InternetCloseHandle
HttpSendRequestA
InternetOpenUrlA
InternetConnectA
InternetOpenA
HttpQueryInfoA
HttpAddRequestHeadersA
InternetQueryOptionA
InternetReadFile
oleaut32
VariantClear
SysAllocString
SysFreeString
Exports
Exports
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Shared Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ