?Dll1Main@@YGHPAUHINSTANCE__@@KPAX@Z
Static task
static1
Behavioral task
behavioral1
Sample
17fef78e81e439524e00000e68c1716d_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
17fef78e81e439524e00000e68c1716d_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
17fef78e81e439524e00000e68c1716d_JaffaCakes118
-
Size
68KB
-
MD5
17fef78e81e439524e00000e68c1716d
-
SHA1
d768265b102a5f9478c23b937e24b558da752a01
-
SHA256
6fbd1703200457fe9164593d7ec589a47fad55cf84666c490aeaa31f2a50de42
-
SHA512
719df1de6ce1978ab7cba7633824ee7651251a4a8da0a7ee2dd9295df7346de3d167012168b60f78964ea3fb1071d3f8256702cf366f47b9f7b595c2f390bf01
-
SSDEEP
768:rXeSGgF0xdb8RmXL8ENIRfB4hkri/g0w/tI3mlwns9gCM87tD9JYfwGibcpg+02:SS/Ydb8W8ENIp+kO/Y1m+v7R9JYY5+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17fef78e81e439524e00000e68c1716d_JaffaCakes118
Files
-
17fef78e81e439524e00000e68c1716d_JaffaCakes118.dll windows:4 windows x86 arch:x86
7b1b6e42852a5aa85c8190dda93c3505
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
urlmon
URLDownloadToFileA
wininet
DeleteUrlCacheEntry
msvcrt
strtol
sscanf
fopen
fseek
ftell
fgetc
fread
fclose
memcpy
memset
time
sprintf
strcmp
strtok
strstr
strcat
printf
strcpy
strlen
kernel32
FreeLibrary
LocalAlloc
lstrcmpiA
CreateToolhelp32Snapshot
Process32First
Process32Next
TerminateProcess
OpenProcess
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
CreateRemoteThread
GetVersionExA
GetModuleFileNameA
Sleep
SetSystemTime
GetSystemTime
CloseHandle
GetFileSize
CreateFileA
WinExec
lstrcpyA
GetFileAttributesA
lstrcatA
GetSystemDirectoryA
lstrlenA
DeleteFileA
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
CreateThread
GetProcAddress
LoadLibraryA
WriteFile
user32
wsprintfA
CharUpperA
FindWindowExA
PostMessageA
ShowWindow
advapi32
CloseServiceHandle
QueryServiceConfigA
ChangeServiceConfigA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
LookupAccountSidA
RegDeleteValueA
RegEnumKeyA
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
GetTokenInformation
shell32
SHGetSpecialFolderPathA
ShellExecuteA
ole32
CoCreateGuid
Exports
Exports
Sections
.text Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 640B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ