Init
Static task
static1
Behavioral task
behavioral1
Sample
4c050cb29652dd21e03f01af16c073bb_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4c050cb29652dd21e03f01af16c073bb_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4c050cb29652dd21e03f01af16c073bb_JaffaCakes118
-
Size
51KB
-
MD5
4c050cb29652dd21e03f01af16c073bb
-
SHA1
76a4e7eede81e6f2a25dc6b00b0ba293b732fff8
-
SHA256
4fa748d87f64403bd1795db5e35d332b4d00f9c5aa0e4a9bd846d434d945bb1a
-
SHA512
bc3caa544cac2533a4b9e976e9919b8e0f140ad272810ee2aa2140b28d8bc99b68f2dfcdf30f34c410bde609cc267342938e3d6c67e3fc65e23f939930ac34ec
-
SSDEEP
1536:r1PhiPC4Qz8CpwJ1VsLVO9R3I6daLvyJt3oUJ24ZLDykZn:r1pizupYcVYN33I4dGkn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4c050cb29652dd21e03f01af16c073bb_JaffaCakes118
Files
-
4c050cb29652dd21e03f01af16c073bb_JaffaCakes118.dll windows:5 windows x86 arch:x86
e78302b39fedf825db0e8972e43e0729
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
recv
WSACleanup
htons
ioctlsocket
select
WSAGetLastError
shutdown
__WSAFDIsSet
WSAStartup
connect
gethostbyname
send
socket
closesocket
psapi
GetModuleBaseNameA
EnumProcessModules
EnumProcesses
crypt32
CryptBinaryToStringA
CryptStringToBinaryA
urlmon
ObtainUserAgentString
kernel32
IsBadWritePtr
GetProcAddress
GetTempFileNameA
LoadLibraryA
DeleteCriticalSection
GetVersionExA
CloseHandle
GetTempPathA
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
SetEvent
Sleep
CreateEventA
ResetEvent
GetModuleFileNameA
VirtualProtect
CreateThread
GetTickCount
CreateFileA
ReadFile
lstrcmpA
MoveFileExA
lstrcpynA
GetFileAttributesA
GetEnvironmentVariableA
FindFirstFileA
CreateProcessA
CopyFileA
SetFileAttributesA
FindClose
OpenEventA
FindNextFileA
GetLocalTime
VirtualAllocEx
GetCurrentProcessId
WriteProcessMemory
WaitNamedPipeA
ConnectNamedPipe
GetOverlappedResult
DisconnectNamedPipe
CreateNamedPipeA
SetNamedPipeHandleState
WaitForMultipleObjects
lstrcpyA
lstrcmpiA
lstrcatA
EnterCriticalSection
LeaveCriticalSection
lstrlenA
OpenProcess
InitializeCriticalSection
WriteFile
WaitForSingleObject
GetLastError
FreeLibrary
GetCurrentProcess
GetModuleHandleA
FlushInstructionCache
CreateEventW
GetComputerNameExA
CreateRemoteThread
advapi32
CheckTokenMembership
AllocateAndInitializeSid
RegCloseKey
RegEnumKeyA
RegCreateKeyExA
RegQueryValueExA
CryptHashData
CryptDestroyHash
CryptDecrypt
RegOpenKeyA
RegEnumValueA
RegDeleteValueA
RegQueryInfoKeyA
CryptDestroyKey
CryptGenKey
CryptCreateHash
RegCreateKeyA
RegSetValueExA
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptAcquireContextW
CryptExportKey
CryptGetHashParam
FreeSid
dnsapi
DnsQuery_A
DnsFree
wininet
InternetTimeFromSystemTimeA
HttpQueryInfoA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCrackUrlA
InternetConnectA
Exports
Exports
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ