_DllMain@12
Static task
static1
Behavioral task
behavioral1
Sample
2f255417c0c0f69d9ed74bd3a226f89c_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2f255417c0c0f69d9ed74bd3a226f89c_JaffaCakes118.dll
Resource
win10v2004-20240708-en
General
-
Target
2f255417c0c0f69d9ed74bd3a226f89c_JaffaCakes118
-
Size
36KB
-
MD5
2f255417c0c0f69d9ed74bd3a226f89c
-
SHA1
e26546b0bc8639c018e87bb092bc887f1ebb1974
-
SHA256
1a0f27589c42d5f28f88b5aa9cafed8d285e20f94f41297cc9138dac464a7e63
-
SHA512
79c40d0b73f60c74d093fcbbde74c2e9e7dba2b47619d17d54406b49f107dbb2a97454696652ed81981261bb00ad87eec7c2cb98908f5d2c0ed40020d859a8f3
-
SSDEEP
384:HaeClFvSYnJ7O5I2abkVwFpopwm0dhc3+yW/Wz:HqjvS8pp2OpopwmCh4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f255417c0c0f69d9ed74bd3a226f89c_JaffaCakes118
Files
-
2f255417c0c0f69d9ed74bd3a226f89c_JaffaCakes118.dll windows:4 windows x86 arch:x86
2abb0362f0709c6632e6e2f002dc443b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
urlmon
URLDownloadToFileA
wininet
DeleteUrlCacheEntry
ws2_32
connect
recv
closesocket
WSACleanup
htons
gethostbyname
socket
WSAStartup
send
msvcrt
atoi
rand
strncpy
strlen
fopen
fseek
ftell
fgetc
fread
fclose
memcpy
memset
time
sprintf
strstr
strcat
strcpy
kernel32
GetLastError
LocalAlloc
lstrcmpiA
GetCurrentProcess
OpenProcess
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
CreateRemoteThread
GetVolumeInformationA
Sleep
SetSystemTime
GetSystemTime
CloseHandle
GetFileSize
CreateFileA
DeleteFileA
WinExec
lstrcatA
GetSystemDirectoryA
CreateThread
lstrcpyA
lstrlenA
GetPrivateProfileStringA
GetPrivateProfileIntA
Process32Next
CreateToolhelp32Snapshot
WritePrivateProfileStringA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetComputerNameA
Process32First
user32
CharUpperA
wsprintfA
advapi32
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
QueryServiceConfigA
ChangeServiceConfigA
OpenServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumKeyA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateGuid
shlwapi
PathFileExistsA
Exports
Exports
Sections
.text Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 640B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ