NSGetModule
Static task
static1
Behavioral task
behavioral1
Sample
1967f2de5d1c80df943623a02140679a_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1967f2de5d1c80df943623a02140679a_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
1967f2de5d1c80df943623a02140679a_JaffaCakes118
-
Size
268KB
-
MD5
1967f2de5d1c80df943623a02140679a
-
SHA1
e6747812859517aef9f6ddee626ba154c438b073
-
SHA256
f21d61fa215a1c04dae22f07e3f286e421f62753295436836ace932ed07e15e1
-
SHA512
b60aa16340286c497d5afba64dfcad6ce3270fc4d06b600610ffeeed7b35c3cce62c330a00af251cc6c7709ccbe062c08119fe0d95b8cccbbaad266e62fb8b68
-
SSDEEP
6144:Kk9LLZWgvWCtJbFPbOEuFIn6d/ed0SRdATt3XMoDEnEK:KkOg+CVde/e2G6ZnDkZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1967f2de5d1c80df943623a02140679a_JaffaCakes118
Files
-
1967f2de5d1c80df943623a02140679a_JaffaCakes118.dll windows:4 windows x86 arch:x86
d0cae588ad251204097f2751c2a4150b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
xpcom_core
?Equals@nsCSubstring@@QBEHABV1@@Z
?StringBeginsWith@@YAHABVnsACString_internal@@0ABVnsCStringComparator@@@Z
??_7nsDefaultCStringComparator@@6B@
PL_DHashClearEntryStub
?Clear@nsCOMArray_base@@IAEXXZ
?CallCreateInstance@@YAIABUnsID@@PAVnsISupports@@0PAPAX@Z
?CallGetService@@YAIABUnsID@@0PAPAX@Z
?AppendUTF8toUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?ToNewCString@@YAPADABVnsACString_internal@@@Z
?NS_NewArrayEnumerator@@YAIPAPAVnsISimpleEnumerator@@ABVnsCOMArray_base@@@Z
?RemoveObjectAt@nsCOMArray_base@@IAEHH@Z
?NS_NewArrayEnumerator@@YAIPAPAVnsISimpleEnumerator@@PAVnsISupportsArray@@@Z
?Assign@nsSubstring@@QAEXPBGI@Z
?AppendASCIItoUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?ToInteger@nsString@@QBEHPAHI@Z
?AppendInt@nsString@@QAEXHH@Z
?Replace@nsSubstring@@QAEXIIPBGI@Z
?sEmptyBuffer@?$nsCharTraits@G@@2PBGB
?Assign@nsSubstring@@QAEXABV1@@Z
?Assign@nsSubstring@@QAEXABVnsAString_internal@@@Z
?Equals@nsSubstring@@QBEHABVnsAString_internal@@@Z
?HashString@@YAIABVnsAString_internal@@@Z
?RemoveElementsAt@nsVoidArray@@QAEHHH@Z
?EqualsASCII@nsSubstring@@QBEHPBDI@Z
?LossyAppendUTF16toASCII@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
?NS_NewAtom@@YAPAVnsIAtom@@ABVnsAString_internal@@@Z
?Trim@nsString@@QAEXPBDHHH@Z
?SizeTo@nsAutoVoidArray@@UAEHH@Z
?Compact@nsAutoVoidArray@@UAEXXZ
?GrowArrayBy@nsVoidArray@@MAEHH@Z
?NS_RegisterStaticAtoms@@YAIPBUnsStaticAtom@@I@Z
?ReplaceASCII@nsCSubstring@@QAEXIIPBDI@Z
??1nsPrintfCString@@QAE@XZ
?assign_from_gs_cid_with_error@nsCOMPtr_base@@QAEXABVnsGetServiceByCIDWithError@@ABUnsID@@@Z
??1nsCOMArray_base@@IAE@XZ
?Assign@nsCSubstring@@QAEXABVnsACString_internal@@@Z
?Length@nsAString_internal@@QBEIXZ
?Assign@nsAString_internal@@QAEXABV1@@Z
?Assign@nsACString_internal@@QAEXABV1@@Z
?Append@nsACString_internal@@QAEXD@Z
?Append@nsACString_internal@@QAEXPBD@Z
?CopyUTF8toUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?StringBeginsWith@@YAHABVnsAString_internal@@0ABVnsStringComparator@@@Z
??_7nsDefaultStringComparator@@6B@
?assign_from_gs_cid@nsCOMPtr_base@@QAEXVnsGetServiceByCID@@ABUnsID@@@Z
?SetLength@nsSubstring@@QAEXI@Z
?Mid@nsString@@QBEIAAV1@II@Z
??0nsQueryReferent@@QAE@PAVnsIWeakReference@@PAI@Z
?strdup@nsCRT@@SAPADPBD@Z
?NS_GetWeakReference@@YAPAVnsIWeakReference@@PAVnsISupports@@PAI@Z
?assign_from_gs_contractid@nsCOMPtr_base@@QAEXVnsGetServiceByContractID@@ABUnsID@@@Z
?ReplaceASCII@nsSubstring@@QAEXIIPBDI@Z
NS_Free_P
?LowerCaseEqualsASCII@nsSubstring@@QBEHPBDI@Z
?EmptyString@@YAABVnsString@@XZ
?RFindChar@nsString@@QBEHGHH@Z
nsEscape
?Find@nsString@@QBEHPBDHHH@Z
?CopyASCIItoUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
??0nsSingletonEnumerator@@QAE@PAVnsISupports@@@Z
?Equals@nsCSubstring@@QBEHPBD@Z
??0nsSupportsWeakReference@@QAE@XZ
?Assign@nsCSubstring@@QAEXPBDI@Z
?GetWeakReference@nsSupportsWeakReference@@UAGIPAPAVnsIWeakReference@@@Z
??_7nsSupportsWeakReference@@6B@
?strdup@nsCRT@@SAPAGPBG@Z
?strcmp@nsCRT@@SAHPBG0@Z
?HashCode@nsCRT@@SAIPBGPAI@Z
?strcmp@nsCRT@@SAHPBD0@Z
?HashCode@nsCRT@@SAIPBDPAI@Z
?Init@nsPromiseFlatCString@@AAEXABVnsACString_internal@@@Z
?Assign@nsCSubstring@@QAEXABVnsCSubstringTuple@@@Z
??0nsGetClassObjectByContractID@@QAE@PBDPAI@Z
??0nsGetClassObjectByCID@@QAE@ABUnsID@@PAI@Z
?GetReadableBuffer@nsACString_internal@@IBEIPAPBD@Z
??0nsArrayEnumerator@@QAE@PAVnsISupportsArray@@@Z
PL_DHashTableRawRemove
?NS_NewISupportsArray@@YAIPAPAVnsISupportsArray@@@Z
PL_DHashTableDestroy
PL_DHashTableEnumerate
??1nsFixedSizeAllocator@@QAE@XZ
?Init@nsFixedSizeAllocator@@QAEIPBDPBIHHH@Z
?Free@nsFixedSizeAllocator@@QAEXPAXI@Z
?Alloc@nsFixedSizeAllocator@@QAEPAXI@Z
?RemoveObject@nsCOMArray_base@@IAEHPAVnsISupports@@@Z
PL_DHashTableOperate
?InsertObjectAt@nsCOMArray_base@@IAEHPAVnsISupports@@H@Z
?assign_with_AddRef@nsCOMPtr_base@@QAEXPAVnsISupports@@@Z
?FindChar@nsCSubstring@@QBEHDI@Z
??0nsVoidArray@@QAE@XZ
NS_NewEmptyEnumerator
?ElementAt@nsVoidArray@@QBEPAXH@Z
PL_DHashGetStubOps
PL_NewDHashTable
NS_NewCStringInputStream
?assign_from_helper@nsCOMPtr_base@@QAEXABVnsCOMPtr_helper@@ABUnsID@@@Z
??0nsCreateInstanceByContractID@@QAE@PBDPAVnsISupports@@PAI@Z
??0nsCreateInstanceByCID@@QAE@ABUnsID@@PAVnsISupports@@PAI@Z
?Length@nsACString_internal@@QBEIXZ
PL_DHashAllocTable
PL_DHashFreeTable
PL_DHashMoveEntryStub
PL_DHashFinalizeStub
PL_DHashTableInit
??0nsAutoVoidArray@@QAE@XZ
?InsertElementAt@nsVoidArray@@QAEHPAXH@Z
?IndexOf@nsVoidArray@@QBEHPAX@Z
??1nsVoidArray@@UAE@XZ
?Clear@nsAutoVoidArray@@UAEXXZ
?RFindChar@nsCString@@QBEHGHH@Z
?CallGetService@@YAIPBDABUnsID@@PAPAX@Z
?assign_from_qi_with_error@nsCOMPtr_base@@QAEXABVnsQueryInterfaceWithError@@ABUnsID@@@Z
?assign_from_qi@nsCOMPtr_base@@QAEXVnsQueryInterface@@ABUnsID@@@Z
?assign_from_gs_contractid_with_error@nsCOMPtr_base@@QAEXABVnsGetServiceByContractIDWithError@@ABUnsID@@@Z
?AppendUTF16toUTF8@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
?AppendUTF16toUTF8@@YAXPBGAAVnsACString_internal@@@Z
?Rebind@nsDependentCSubstring@@QAEXABVnsCSubstring@@II@Z
?NS_NewAtom@@YAPAVnsIAtom@@ABVnsACString_internal@@@Z
?NS_NewAtom@@YAPAVnsIAtom@@PBD@Z
?AssignASCII@nsCSubstring@@QAEXPBDI@Z
?Equals@nsACString_internal@@QBEHABV1@@Z
PL_DHashTableFinish
?SetLength@nsCSubstring@@QAEXI@Z
?Adopt@nsCSubstring@@QAEXPADI@Z
?AppendInt@nsCString@@QAEXHH@Z
?Assign@nsCSubstring@@QAEXABV1@@Z
??1nsACString_internal@@QAE@XZ
??1nsAString_internal@@QAE@XZ
??1nsCOMPtr_base@@QAE@XZ
?sEmptyBuffer@?$nsCharTraits@D@@2PBDB
?Replace@nsCSubstring@@QAEXIIPBDI@Z
?EnsureMutable@nsCSubstring@@IAEXXZ
?sCanonicalVTable@nsObsoleteACString@@2PBXB
?sCanonicalVTable@nsObsoleteAString@@2PBXB
??0nsPrintfCString@@QAA@IPBDZZ
?NS_NewGenericModule2@@YAIPBUnsModuleInfo@@PAPAVnsIModule@@@Z
nspr4
PR_Malloc
PR_Free
PR_AtomicIncrement
PR_AtomicDecrement
PR_Now
PR_Realloc
PR_FormatTimeUSEnglish
PR_ExplodeTime
PR_LocalTimeParameters
PR_smprintf
PR_ParseTimeString
plc4
PL_strncmp
PL_strfree
PL_strdup
plds4
PL_HashTableDestroy
PL_HashTableAdd
PL_HashTableRawLookup
PL_HashTableRawRemove
PL_NewHashTable
PL_HashString
PL_CompareStrings
PL_CompareValues
PL_HashTableLookup
kernel32
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
GetDriveTypeA
SetUnhandledExceptionFilter
msvcr80
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
free
_encoded_null
_malloc_crt
_encode_pointer
tolower
sprintf
strncmp
strchr
atoi
_purecall
strlen
??_V@YAXPAX@Z
memcmp
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
?terminate@@YAXXZ
Exports
Exports
Sections
.text Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE