Static task
static1
Behavioral task
behavioral1
Sample
370ae80c94a33a6f5d3d183d71329af2_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
370ae80c94a33a6f5d3d183d71329af2_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
370ae80c94a33a6f5d3d183d71329af2_JaffaCakes118
-
Size
42KB
-
MD5
370ae80c94a33a6f5d3d183d71329af2
-
SHA1
be87d0ce15ad93a2ba8c9f00d82198d9dd1bd121
-
SHA256
78ade95077b542af8be927d9ec5eac3ac7ee121af901f618f029902f8cb7d93f
-
SHA512
c383f05f17f743d3c0a561a414ab01256cc73543b2c301d19ebf627751ddb8624c03f4a9ee6f1a46a739fb91fadf1690de4ad640274b97710eea3bfc6544f01b
-
SSDEEP
768:xsnnWkppMRjX2PYBt6qdcSUz5WZlPhLMqt9u84v:xsnnWkpmRD22t6q2SU9WNLTt9qv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 370ae80c94a33a6f5d3d183d71329af2_JaffaCakes118
Files
-
370ae80c94a33a6f5d3d183d71329af2_JaffaCakes118.dll windows:4 windows x86 arch:x86
4e053c4135fb1e4aeb8cb43f291c07a7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord2915
ord1158
ord540
ord860
ord535
ord858
ord2846
ord537
ord2764
ord6648
ord4129
ord800
ord825
ord1168
ord823
msvcrt
_adjust_fdiv
_initterm
free
malloc
strncmp
exit
strncpy
strstr
sprintf
strchr
srand
time
atoi
__CxxFrameHandler
rand
_strcmpi
kernel32
lstrlenA
CreateThread
Sleep
ExitThread
GetProcAddress
CloseHandle
CreateProcessA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetSystemDirectoryA
TerminateProcess
CreateRemoteThread
VirtualAllocEx
GetModuleHandleA
WriteProcessMemory
CreateMutexA
GetLastError
GetVersionExA
GetTempPathA
WinExec
OpenProcess
user32
wsprintfA
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
urlmon
URLDownloadToFileA
wsock32
ioctlsocket
htons
socket
closesocket
WSAStartup
connect
recv
__WSAFDIsSet
select
gethostbyname
setsockopt
send
winmm
timeGetTime
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ