Static task
static1
Behavioral task
behavioral1
Sample
47b64a2138286850d2e855455c869aa5_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
47b64a2138286850d2e855455c869aa5_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
47b64a2138286850d2e855455c869aa5_JaffaCakes118
-
Size
40KB
-
MD5
47b64a2138286850d2e855455c869aa5
-
SHA1
fe118ed3386637ab4b003c2c169751b193b88398
-
SHA256
c5400e66e3d8e6b569be48d890aa8554206f79bfc7f900ba9babf5226481b013
-
SHA512
8c91be6690a0eb8295cb7dbc6b8ab8b64ed75dd84288ec794a7daa1cefaa9e2d86383b4ffc0bc551128b236153f947f7dbf225789fa449728d9adbb3fdb1c07d
-
SSDEEP
768:sodTu9XPLKqzd+8qJ+tmMH0DdPjY3JeuOy:sodTg2F1JemMH05PjY3JeuO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 47b64a2138286850d2e855455c869aa5_JaffaCakes118
Files
-
47b64a2138286850d2e855455c869aa5_JaffaCakes118.dll windows:4 windows x86 arch:x86
86bdf801f1b8b619c4dcd8befaa0ed4f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord2846
ord2764
ord6648
ord2915
ord4129
ord5710
ord922
ord537
ord926
ord924
ord540
ord535
ord858
ord6663
ord860
ord4278
ord800
ord2818
ord939
ord6877
ord1168
msvcrt
_adjust_fdiv
malloc
_initterm
free
strstr
strncmp
strchr
strtok
exit
_stricmp
printf
fprintf
_mbscmp
__CxxFrameHandler
atoi
time
srand
rand
_except_handler3
_iob
kernel32
OpenProcess
GetTempPathA
CreateProcessA
GetSystemDirectoryA
CreateThread
Process32Next
TerminateProcess
CreateToolhelp32Snapshot
GetCurrentProcess
GlobalMemoryStatus
GetVersionExA
ExitThread
Sleep
GetLastError
ExitProcess
GetCurrentProcessId
GetTickCount
CloseHandle
HeapAlloc
GetProcessHeap
Process32First
TerminateThread
user32
ExitWindowsEx
wsprintfA
advapi32
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
OpenServiceA
DeleteService
OpenSCManagerA
urlmon
URLDownloadToFileA
ws2_32
sendto
gethostbyname
inet_addr
htons
setsockopt
WSASocketA
WSAStartup
gethostname
WSACleanup
closesocket
htonl
ntohl
WSAGetLastError
connect
socket
send
inet_ntoa
recv
__WSAFDIsSet
select
Sections
.text Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ