ReaperPluginEntry
Static task
static1
Behavioral task
behavioral1
Sample
1b4b8dd531f10a824bd394fa34070b60_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1b4b8dd531f10a824bd394fa34070b60_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
1b4b8dd531f10a824bd394fa34070b60_JaffaCakes118
-
Size
189KB
-
MD5
1b4b8dd531f10a824bd394fa34070b60
-
SHA1
5e4904df8761c16e62fb2baea2de6d76b166014c
-
SHA256
9d5960f6602bfae8e24a3a082477554756cd06fefe167c7c6c6e74f305afe0bf
-
SHA512
c2b5079911e75fdf00f663db5aa2cc4090dac6ee6c7e2b4fabdd0c6a5d032db559f29d05d63c2edf3d985125011dc4f8507847b41eb462adbeb0f89dd542a971
-
SSDEEP
3072:smmx/3R5/Ku9PIo4bB9upNM4xpeR1CLt+vfZliR6x6sTSDA:16pBKtZam4xpq1UaZliR6x6sTSD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b4b8dd531f10a824bd394fa34070b60_JaffaCakes118
Files
-
1b4b8dd531f10a824bd394fa34070b60_JaffaCakes118.dll windows:4 windows x86 arch:x86
e434782960d931367f01603d07f1fa63
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
lstrcpynA
GetTickCount
ReadFile
SetFilePointer
GetFileSize
GetLastError
ResetEvent
GetOverlappedResult
WriteFile
CreateEventA
CloseHandle
UnmapViewOfFile
WaitForSingleObject
MapViewOfFile
CreateFileMappingA
CreateFileA
CreateFileW
MultiByteToWideChar
GetVersion
InitializeCriticalSection
DeleteCriticalSection
FindClose
FindNextFileA
FindNextFileW
WideCharToMultiByte
FindFirstFileA
FindFirstFileW
CreateThread
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
user32
CreateDialogParamA
SetWindowTextA
SetTimer
EndDialog
SetDlgItemTextA
EnableWindow
GetDlgItemTextA
DialogBoxParamA
MessageBoxA
IsDlgButtonChecked
CheckDlgButton
GetDlgItem
ShowWindow
SendDlgItemMessageA
GetDlgItemInt
SendMessageA
SetDlgItemInt
shell32
ShellExecuteA
winmm
timeGetTime
msvcrt
_strdup
_stricmp
_adjust_fdiv
_initterm
_onexit
__dllonexit
strtol
strtoul
atof
strchr
isdigit
strncmp
_vsnprintf
floor
strstr
_strnicmp
atoi
memmove
??3@YAXPAX@Z
free
??2@YAPAXI@Z
malloc
realloc
sprintf
_ftol
_purecall
wsock32
sendto
recvfrom
closesocket
inet_ntoa
bind
setsockopt
socket
inet_addr
getsockname
connect
WSAStartup
WSACleanup
shutdown
htonl
ioctlsocket
htons
Exports
Exports
Sections
.text Size: 156KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ