Static task
static1
Behavioral task
behavioral1
Sample
39781bbb0634aad738178490059653c7_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
39781bbb0634aad738178490059653c7_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
39781bbb0634aad738178490059653c7_JaffaCakes118
-
Size
68KB
-
MD5
39781bbb0634aad738178490059653c7
-
SHA1
aeb7c3927ee6f69860d1b653941c1fd4c34765b9
-
SHA256
a9460b5fe1c0c0937c1e5d9b91f772a88adeeb9862854167d2a89c30318e0a24
-
SHA512
1e2957efaa2dfb6c1539e26021614e1f1945ecde49483466182b12833cfa1d67fd1edded55ff14328c98577d8d649adf93ab03839deb9c0539edf77c6eaa1806
-
SSDEEP
1536:MQADzFVcn6IIdjz5uqmgxyJHDXu9u+j7S:TAD5VcnAn8+HS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 39781bbb0634aad738178490059653c7_JaffaCakes118
Files
-
39781bbb0634aad738178490059653c7_JaffaCakes118.dll windows:4 windows x86 arch:x86
4325a9deb8907c8cab178362f98bf08f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord2846
ord825
ord823
ord941
ord2764
ord4129
ord6648
ord922
ord537
ord926
ord924
ord2915
ord540
ord535
ord858
ord6663
ord1168
ord860
ord4278
ord800
ord2818
ord939
ord6877
msvcrt
_adjust_fdiv
_initterm
malloc
free
exit
strncpy
printf
sprintf
_strcmpi
atoi
strchr
strstr
__CxxFrameHandler
time
srand
rand
kernel32
WriteProcessMemory
TerminateProcess
CloseHandle
CreateRemoteThread
WaitForSingleObject
TerminateThread
CreateThread
GetTickCount
OpenProcess
ExitThread
CreateToolhelp32Snapshot
LoadLibraryA
GlobalMemoryStatusEx
lstrcpyA
GetVersionExA
WinExec
GetTempPathA
CreateEventA
GetProcAddress
GetModuleHandleA
CreateProcessA
Process32Next
Sleep
VirtualAllocEx
CreateMutexA
GetLastError
ExitProcess
Process32First
user32
wsprintfA
advapi32
DeleteService
OpenSCManagerA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
OpenServiceA
urlmon
URLDownloadToFileA
ws2_32
connect
htons
socket
sendto
htonl
inet_addr
setsockopt
WSASocketA
WSAStartup
send
recv
inet_ntoa
gethostbyname
__WSAFDIsSet
select
WSACleanup
WSAGetLastError
closesocket
winmm
timeGetTime
Sections
.text Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ