NSGetModule
Static task
static1
Behavioral task
behavioral1
Sample
43b2772ac9107eee6da5df5e7d47a035_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
43b2772ac9107eee6da5df5e7d47a035_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
43b2772ac9107eee6da5df5e7d47a035_JaffaCakes118
-
Size
1.6MB
-
MD5
43b2772ac9107eee6da5df5e7d47a035
-
SHA1
4e3e2beffab385c2f4e8da180d106893ee2ebee1
-
SHA256
b9c6d80fa6af84a90cfb588a4621b125a7ae30ce1d8604bc7ee8d6bda9a1f9c3
-
SHA512
12c6878273f71d0c068793300a889e0e3d1320c20f8f5effbaa6b71c865a15d3d25117ea847c8007f6674bc92a3263fb0ded5320db6350b1f8d03b3579cd4dda
-
SSDEEP
24576:AjKwEnbX4J6TqNMCACrjkbBsUpr3Y3KJIEQDYdZmrHuA8LVULl55smwQc9+bNTYq:WEs7k6OrxAB+UqC5bNTY+TnxpUx03
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 43b2772ac9107eee6da5df5e7d47a035_JaffaCakes118
Files
-
43b2772ac9107eee6da5df5e7d47a035_JaffaCakes118.dll windows:4 windows x86 arch:x86
3245331ed2de38d3b3ee18313bdba289
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedIncrement
InterlockedDecrement
GetProcAddress
LoadLibraryA
DeleteCriticalSection
SetEnvironmentVariableA
GetLocaleInfoW
GetDriveTypeA
SetEndOfFile
CreateFileA
GetCurrentDirectoryW
CreateFileW
SetStdHandle
GetOEMCP
GetACP
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
ReadFile
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryW
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
LeaveCriticalSection
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
RaiseException
HeapFree
GetLastError
CreateThread
GetCurrentThreadId
TlsSetValue
ExitThread
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
HeapAlloc
HeapReAlloc
ExitProcess
LCMapStringA
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
TerminateProcess
GetCurrentProcess
HeapSize
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
SetUnhandledExceptionFilter
VirtualAlloc
IsBadWritePtr
CloseHandle
SetFilePointer
FlushFileBuffers
UnhandledExceptionFilter
GetFullPathNameW
GetCurrentDirectoryA
user32
SetWindowLongW
IsWindow
SendMessageW
IsWindowVisible
ShowWindow
xpcom
NS_StringContainerFinish
NS_StringContainerInit
NS_StringGetData
NS_StringContainerInit2
NS_CStringGetData
NS_CStringContainerFinish
NS_CStringSetData
NS_CStringContainerInit
NS_Free
NS_Alloc
NS_GetServiceManager
NS_GetComponentManager
nspr4
PR_AtomicDecrement
PR_AtomicIncrement
oleaut32
VariantClear
SysAllocString
SysFreeString
Exports
Exports
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 116KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ