NSGetModule
Static task
static1
Behavioral task
behavioral1
Sample
3f52589040bd77ac54d818dc5a2a2ce9_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3f52589040bd77ac54d818dc5a2a2ce9_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3f52589040bd77ac54d818dc5a2a2ce9_JaffaCakes118
-
Size
312KB
-
MD5
3f52589040bd77ac54d818dc5a2a2ce9
-
SHA1
3b10c3e5924dae332ae1209dde397d9ec081aa9b
-
SHA256
b71ceeb9e94094ad8a702e5c5f9de0d2fe3cfa7ea9cfe7d860fdce4fcf7e1071
-
SHA512
2a42273a7ed049eb130b6ee1f5c674d430257b16ee79ae03c751808c3ca08f0c4d222cb98c12c38d469a2347559879b7560298e6c747c6cc863d03d21d0e5d8a
-
SSDEEP
6144:ySlXKWHx/dP9d+Rque//kXNWSldj+1qB8A4kgqe21Vzb:ySlXKmx/t0e3yASq1qB+kghO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f52589040bd77ac54d818dc5a2a2ce9_JaffaCakes118
Files
-
3f52589040bd77ac54d818dc5a2a2ce9_JaffaCakes118.dll windows:4 windows x86 arch:x86
26355a14fce2f409abf22e8f7f72b2fb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
xul
?Assign@nsSubstring@@QAEXABVnsAString_internal@@@Z
?GrowArrayBy@nsVoidArray@@MAEHH@Z
?Compact@nsVoidArray@@UAEXXZ
?SizeTo@nsVoidArray@@UAEHH@Z
?Clear@nsVoidArray@@UAEXXZ
??0nsVoidArray@@QAE@XZ
??1nsVoidArray@@UAE@XZ
?EqualsASCII@nsAString_internal@@QBEHPBDI@Z
?AssignASCII@nsAString_internal@@QAEXPBDI@Z
?assign_with_AddRef@nsCOMPtr_base@@QAEXPAVnsISupports@@@Z
?Assign@nsAString_internal@@QAEXABVnsSubstringTuple@@@Z
?Replace@nsSubstring@@QAEXIIPBGI@Z
?Rebind@nsDependentSubstring@@QAEXABVnsAString_internal@@II@Z
?NS_NewAtom@@YAPAVnsIAtom@@ABVnsAString_internal@@@Z
?FindChar@nsAString_internal@@QBEHGI@Z
?Assign@nsSubstring@@QAEXABVnsSubstringTuple@@@Z
?LowerCaseEqualsASCII@nsSubstring@@QBEHPBDI@Z
?AppendASCIItoUTF16@@YAXPBDAAVnsAString_internal@@@Z
?Assign@nsSubstring@@QAEXABV1@@Z
?AppendASCII@nsAString_internal@@QAEXPBDI@Z
NS_Alloc_P
NS_Free_P
??1nsPrintfCString@@QAE@XZ
?CopyASCIItoUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
??0nsPrintfCString@@QAA@IPBDZZ
??0nsAutoVoidArray@@QAE@XZ
?AppendUTF8toUTF16@@YAXPBDAAVnsAString_internal@@@Z
?Append@nsAString_internal@@QAEXG@Z
?Equals@nsSubstring@@QBEHABVnsAString_internal@@@Z
?Equals@nsSubstring@@QBEHABV1@ABVnsStringComparator@@@Z
?StringBeginsWith@@YAHABVnsAString_internal@@0ABVnsStringComparator@@@Z
??_7nsDefaultStringComparator@@6B@
?SetCapacity@nsSubstring@@QAEXI@Z
?Find@nsString@@QBEHABV1@HH@Z
?Adopt@nsSubstring@@QAEXPAGI@Z
??1nsCOMArray_base@@IAE@XZ
?assign_from_qi_with_error@nsCOMPtr_base@@QAEXABVnsQueryInterfaceWithError@@ABUnsID@@@Z
?EmptyString@@YAABVnsString@@XZ
?Assign@nsSubstring@@QAEXPBGI@Z
PL_DestroyEvent
PL_InitEvent
?ElementAt@nsVoidArray@@QBEPAXH@Z
?Equals@nsAString_internal@@QBEHABV1@ABVnsStringComparator@@@Z
?Replace@nsSubstring@@QAEXIIABVnsAString_internal@@@Z
?ReplaceASCII@nsSubstring@@QAEXIIPBDI@Z
??1nsACString_internal@@QAE@XZ
?Clear@nsCOMArray_base@@IAEXXZ
?InsertObjectAt@nsCOMArray_base@@IAEHPAVnsISupports@@H@Z
?RemoveObject@nsCOMArray_base@@IAEHPAVnsISupports@@@Z
?LossyAppendUTF16toASCII@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
?CompressWhitespace@nsString@@QAEXHH@Z
?Assign@nsCSubstring@@QAEXABV1@@Z
?AppendUTF8toUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?Equals@nsCSubstring@@QBEHPBD@Z
?HashString@@YAIABVnsAString_internal@@@Z
?InsertStringAt@nsStringArray@@QAEHABVnsAString_internal@@H@Z
?RemoveStringAt@nsStringArray@@QAEHH@Z
?StringAt@nsStringArray@@QBEXHAAVnsAString_internal@@@Z
PL_DHashTableOperate
PL_DHashTableRawRemove
PL_DHashTableFinish
??0nsStringArray@@QAE@XZ
??1nsStringArray@@UAE@XZ
PL_DHashTableInit
PL_DHashFinalizeStub
PL_DHashMoveEntryStub
PL_DHashFreeTable
PL_DHashAllocTable
?NS_NewAtom@@YAPAVnsIAtom@@PBD@Z
?EqualsASCII@nsSubstring@@QBEHPBD@Z
?EnumerateForwards@nsVoidArray@@QAEHP6AHPAX0@Z0@Z
?RemoveElement@nsVoidArray@@QAEHPAX@Z
??4nsVoidArray@@QAEAAV0@ABV0@@Z
?GetReadableBuffer@nsAString_internal@@IBEIPAPBG@Z
?IndexOf@nsStringArray@@QBEHABVnsAString_internal@@@Z
?Init@nsPromiseFlatString@@AAEXABVnsSubstring@@@Z
?Append@nsAString_internal@@QAEXPBGI@Z
?SetCharAt@nsString@@QAEHGI@Z
?RFindChar@nsString@@QBEHGHH@Z
NS_QuickSort
?GetWritableBuffer@nsAString_internal@@IAEIPAPAG@Z
?EnsureMutable@nsSubstring@@IAEXXZ
?RemoveElementsAt@nsVoidArray@@QAEHHH@Z
?InsertElementAt@nsVoidArray@@QAEHPAXH@Z
?SetLength@nsSubstring@@QAEXI@Z
?AssignASCII@nsSubstring@@QAEXPBDI@Z
?EqualsASCII@nsSubstring@@QBEHPBDI@Z
?NS_GetWeakReference@@YAPAVnsIWeakReference@@PAVnsISupports@@PAI@Z
?IsVoid@nsAString_internal@@QBEHXZ
?Init@nsPromiseFlatString@@AAEXABVnsAString_internal@@@Z
??0nsQueryReferent@@QAE@PAVnsIWeakReference@@PAI@Z
?Equals@nsSubstring@@QBEHABV1@@Z
?FindChar@nsSubstring@@QBEHGI@Z
?Equals@nsAString_internal@@QBEHABV1@@Z
?assign_from_helper@nsCOMPtr_base@@QAEXABVnsCOMPtr_helper@@ABUnsID@@@Z
?Rebind@nsDependentSubstring@@QAEXABVnsSubstring@@II@Z
??0nsCreateInstanceByContractID@@QAE@PBDPAVnsISupports@@PAI@Z
??0nsCreateInstanceByCID@@QAE@ABUnsID@@PAVnsISupports@@PAI@Z
?SetIsVoid@nsAString_internal@@QAEXH@Z
?sEmptyBuffer@?$nsCharTraits@G@@2PBGB
?SetLength@nsAString_internal@@QAEXI@Z
?Append@nsAString_internal@@QAEXABV1@@Z
?assign_from_qi@nsCOMPtr_base@@QAEXVnsQueryInterface@@ABUnsID@@@Z
?assign_from_gs_cid_with_error@nsCOMPtr_base@@QAEXABVnsGetServiceByCIDWithError@@ABUnsID@@@Z
?CopyUTF8toUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?AppendUTF16toUTF8@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
??1nsAString_internal@@QAE@XZ
?sCanonicalVTable@nsObsoleteAString@@2PBXB
?Assign@nsAString_internal@@QAEXABV1@@Z
?Length@nsAString_internal@@QBEIXZ
?ToString@nsID@@QBEPADXZ
?free@nsCRT@@SAXPAD@Z
?CallGetService@@YAIPBDABUnsID@@PAPAX@Z
?assign_from_gs_contractid@nsCOMPtr_base@@QAEXVnsGetServiceByContractID@@ABUnsID@@@Z
?assign_from_gs_contractid_with_error@nsCOMPtr_base@@QAEXABVnsGetServiceByContractIDWithError@@ABUnsID@@@Z
?strcmp@nsCRT@@SAHPBD0@Z
?NS_NewGenericModule2@@YAIPBUnsModuleInfo@@PAPAVnsIModule@@@Z
??1nsCOMPtr_base@@QAE@XZ
?Adopt@nsCSubstring@@QAEXPADI@Z
?InsertElementsAt@nsVoidArray@@QAEHABV1@H@Z
?NS_RegisterStaticAtoms@@YAIPBUnsStaticAtom@@I@Z
?Replace@nsCSubstring@@QAEXIIPBDI@Z
??0nsCOMArray_base@@IAE@ABV0@@Z
?IndexOf@nsVoidArray@@QBEHPAX@Z
?RemoveObjectAt@nsCOMArray_base@@IAEHH@Z
?ReplaceElementAt@nsVoidArray@@QAEHPAXH@Z
?NS_NewAtom@@YAPAVnsIAtom@@ABVnsACString_internal@@@Z
?Append@nsAString_internal@@QAEXABVnsSubstringTuple@@@Z
?sEmptyBuffer@?$nsCharTraits@D@@2PBDB
?LossyCopyUTF16toASCII@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
?sCanonicalVTable@nsObsoleteACString@@2PBXB
nspr4
PR_Malloc
PR_Free
PR_dtoa
PR_LocalTimeParameters
PR_Now
PR_ExplodeTime
PR_snprintf
PR_FormatTime
PR_strtod
js3250
JS_ValueToString
JS_GetStringChars
JS_GetStringLength
msvcp71
?_Nomemory@std@@YAXXZ
msvcr71
_except_handler3
__CppXcptFilter
_adjust_fdiv
_initterm
free
_callnewh
malloc
tolower
__dllonexit
log10
ceil
floor
fmod
memmove
memcpy
??_V@YAXPAX@Z
memset
??3@YAXPAX@Z
_purecall
fabs
_onexit
kernel32
DisableThreadLibraryCalls
Exports
Exports
Sections
.text Size: 148KB - Virtual size: 146KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE