?Dll2Main@@YGHPAUHINSTANCE__@@KPAX@Z
Static task
static1
Behavioral task
behavioral1
Sample
457340792db16e69659a7603c933f0e3_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
457340792db16e69659a7603c933f0e3_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
457340792db16e69659a7603c933f0e3_JaffaCakes118
-
Size
36KB
-
MD5
457340792db16e69659a7603c933f0e3
-
SHA1
ba688cd5c5c31f1198afde1993e91d18ed5e9e7e
-
SHA256
1f13f23a041242f9d96cbfba32ff344fec927e502301933ed2b5a4b966afb808
-
SHA512
61dd6ee6a56b955fc565549a973653d37041e566951e5245f1ae1570381ae990efdc554bec2216bcaf6a49e839301914a177046367d45c71bf32533d06fc21b1
-
SSDEEP
384:f6PtEh6uMZOP8NRjr0PbaI0ISWTcGudhbkW/W/WAX:fwS6uMZUo29SWwG4hny
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 457340792db16e69659a7603c933f0e3_JaffaCakes118
Files
-
457340792db16e69659a7603c933f0e3_JaffaCakes118.dll windows:4 windows x86 arch:x86
89dbf06808eb5a46a730c5b76fc0caba
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
urlmon
URLDownloadToFileA
wininet
DeleteUrlCacheEntry
msvcrt
strlen
fopen
fseek
ftell
fgetc
fread
fclose
printf
srand
memcpy
memset
time
sprintf
strstr
rand
strcat
strcpy
kernel32
GetLastError
SetFileAttributesA
WritePrivateProfileStringA
LocalAlloc
lstrcmpiA
GetCurrentProcess
OpenProcess
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
CreateRemoteThread
GetVolumeInformationA
CopyFileA
Sleep
SetSystemTime
GetSystemTime
CloseHandle
GetFileSize
CreateFileA
DeleteFileA
WinExec
lstrcatA
GetSystemDirectoryA
CreateThread
lstrcpyA
lstrlenA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetComputerNameA
Process32Next
Process32First
CreateToolhelp32Snapshot
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
user32
CharUpperA
wsprintfA
advapi32
RegCloseKey
QueryServiceConfigA
ChangeServiceConfigA
OpenServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegEnumKeyA
RegOpenKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
shlwapi
StrCmpNIA
PathFileExistsA
Exports
Exports
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 640B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ