_WLX@4
Static task
static1
Behavioral task
behavioral1
Sample
384a743c20b94cf867d0262f80a544f7_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
384a743c20b94cf867d0262f80a544f7_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
384a743c20b94cf867d0262f80a544f7_JaffaCakes118
-
Size
205KB
-
MD5
384a743c20b94cf867d0262f80a544f7
-
SHA1
2ea64495db334bfeea341472f20d67df9dcf7b6b
-
SHA256
b89066444bb07452ab0d8970f4dffd6a9aae175678cd67db591e7bd4211ca8e3
-
SHA512
ff8724deb1c82c6b103d9e8836d6138b1c7994e5e79f2ffcd1cecf89e25d471f61d41fbf88c9995e5a0ed9d0ab1a1c73e88151ca8353b5bb14d569add075f630
-
SSDEEP
3072:6aV9aQP9bGWwGMXSUFINEtNJfBQIEsX9KggFTBfR01WcZ:NP9bGWwGMX/qNEPJfestKggFTBJGdZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 384a743c20b94cf867d0262f80a544f7_JaffaCakes118
Files
-
384a743c20b94cf867d0262f80a544f7_JaffaCakes118.dll windows:5 windows x86 arch:x86
2d3c0fd464296f8c45ff15d35dd18cca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
wininet
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetReadFile
InternetConnectA
HttpQueryInfoA
kernel32
SetEnvironmentVariableA
GetOEMCP
GetACP
GetCPInfo
HeapSize
InterlockedDecrement
ExitProcess
CreateFileA
FreeLibrary
WriteFile
TerminateThread
Sleep
CreateProcessA
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetVersionExA
CloseHandle
CreateThread
GetFileSize
MapViewOfFile
UnmapViewOfFile
GetWindowsDirectoryA
CreateFileMappingA
VirtualProtect
GetLastError
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
OpenThread
GetExitCodeThread
DeleteCriticalSection
GetCurrentThreadId
GetCurrentProcessId
SystemTimeToFileTime
GetSystemTime
GetVolumeInformationA
HeapAlloc
HeapFree
GetProcessHeap
SetLastError
InterlockedIncrement
CompareStringW
GetStringTypeW
HeapReAlloc
RtlUnwind
LoadLibraryW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
TlsFree
GetFileType
SetHandleCount
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
LCMapStringW
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
WideCharToMultiByte
GetTimeZoneInformation
GetCommandLineA
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetModuleHandleW
GetStdHandle
GetModuleFileNameW
TlsAlloc
TlsGetValue
TlsSetValue
IsValidCodePage
user32
wsprintfA
ws2_32
connect
select
shutdown
setsockopt
recv
send
gethostname
ioctlsocket
inet_ntoa
recvfrom
inet_addr
WSAGetLastError
htons
ntohs
sendto
socket
closesocket
gethostbyname
getnameinfo
WSAStartup
WSACleanup
__WSAFDIsSet
Exports
Exports
Sections
.text Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ