Static task
static1
Behavioral task
behavioral1
Sample
35acf446163fab1fa7e2e35133843113_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
35acf446163fab1fa7e2e35133843113_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
35acf446163fab1fa7e2e35133843113_JaffaCakes118
-
Size
24KB
-
MD5
35acf446163fab1fa7e2e35133843113
-
SHA1
affc2b1d9d69df6bd924a693a0c9237049078f62
-
SHA256
a8cf8fbc20fa71258dde5a830c30ea4080050d77340ef67c693682d5b3c36d2c
-
SHA512
6480489cbd611bb6e1b0d79c52c7e63b4f1c9983d039255bbb4b06ad3379e0a8e31f7b1571a60c2f679129ad0d6d63f4a9a3ac732becd45735066934542ab122
-
SSDEEP
384:QW9WullqEJxYVRXzh9r4KSpct5LooaZv:x97tAVRXzh9r4dat5paZv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 35acf446163fab1fa7e2e35133843113_JaffaCakes118
Files
-
35acf446163fab1fa7e2e35133843113_JaffaCakes118.dll windows:4 windows x86 arch:x86
d4c6718d56bdc5d19b067282ce7b9d97
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
closesocket
ntohs
ntohl
msvcrt
free
_initterm
strchr
_adjust_fdiv
_itoa
atoi
memcpy
strncpy
strcmp
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
malloc
kernel32
Sleep
GetCommandLineA
ExitProcess
GetModuleHandleA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
CreateThread
Sections
.text Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 726B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ