Static task
static1
Behavioral task
behavioral1
Sample
188cf2a7884fa15b4464087146a8c6ac_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
188cf2a7884fa15b4464087146a8c6ac_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
188cf2a7884fa15b4464087146a8c6ac_JaffaCakes118
-
Size
96KB
-
MD5
188cf2a7884fa15b4464087146a8c6ac
-
SHA1
4fb433a64f857d46389c8b9ae9ba4fbd0faedd9f
-
SHA256
8f5444de790648444399544118f9d462b7f8eadec8dac7e3dd14a0922872ad04
-
SHA512
6aaa08e66697b90603064e2a620bddc5f492cb670f2e6699a1da87783db2c97b69c1950a3b03a4cf00606a501b807b38d5b8d60d6cda1d9c9f116436762571c0
-
SSDEEP
1536:RKcY0Z6QieckyU7hLI2XNC/TfAxlwU2G7rXwkB2sud:RKcY39BU7+2Jt2KrXX2sE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 188cf2a7884fa15b4464087146a8c6ac_JaffaCakes118
Files
-
188cf2a7884fa15b4464087146a8c6ac_JaffaCakes118.dll windows:4 windows x86 arch:x86
f22ed9e54295b132e89687811ba37aaa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord389
ord540
ord5207
ord5356
ord1988
ord2915
ord800
ord690
ord823
ord825
msvcrt
_adjust_fdiv
_initterm
strstr
__CxxFrameHandler
tolower
strtol
memset
time
clock
srand
sprintf
atoi
strcpy
rand
malloc
free
strlen
strcat
kernel32
CreateProcessA
GetPrivateProfileIntA
LoadResource
Sleep
DeleteFileA
GetSystemDirectoryA
CloseHandle
CreateThread
WriteFile
FreeLibraryAndExitThread
CreateFileA
OpenProcess
VirtualAllocEx
WriteProcessMemory
LoadLibraryA
CreateRemoteThread
GetCurrentProcess
GetFileSize
DeviceIoControl
GetPrivateProfileStringA
FindResourceA
SizeofResource
LockResource
user32
GetWindowTextA
EnumWindows
advapi32
CloseServiceHandle
CreateServiceA
OpenSCManagerA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
StartServiceA
shell32
SHGetFolderPathA
ws2_32
inet_addr
closesocket
gethostbyname
send
connect
htons
socket
inet_ntoa
recv
iphlpapi
GetAdaptersInfo
psapi
EnumProcesses
Sections
.text Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 842B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ