Static task
static1
Behavioral task
behavioral1
Sample
5a8c73da7196203ff4383315bcda4fe6_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5a8c73da7196203ff4383315bcda4fe6_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5a8c73da7196203ff4383315bcda4fe6_JaffaCakes118
-
Size
56KB
-
MD5
5a8c73da7196203ff4383315bcda4fe6
-
SHA1
f02854f6d9f1eef240c1d42fad17ecc1adc327f9
-
SHA256
e8b2efcac980d1eaef3c4160a385c4fece95e78cc7396304fe8f6cb0b53514fc
-
SHA512
e2f51f7415da55c7adbeab786fdb1ef1643ed07d4ff4ffea1a7461462e4e48ea8787993cd763219cd262593202b09977d8d537fe3e35473de8a848395f89a4ea
-
SSDEEP
768:6F3qdEHxJylmstkLmlKuRozOf5d6h4K3RlB:6dw+ylmSPR75dJYL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a8c73da7196203ff4383315bcda4fe6_JaffaCakes118
Files
-
5a8c73da7196203ff4383315bcda4fe6_JaffaCakes118.dll windows:4 windows x86 arch:x86
d351d6b1b12b577df92f187b8e947633
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc71
ord297
ord907
ord2322
ord876
ord4109
ord784
ord2272
ord781
ord578
ord5491
ord310
ord2902
ord304
ord2468
ord2348
ord1489
ord299
ord2933
ord6118
ord1482
ord5563
ord3997
ord1916
ord1084
ord764
msvcr71
_except_handler3
printf
fprintf
_iob
rand
srand
time
atoi
__CxxFrameHandler
exit
strtok
strchr
strncmp
strstr
malloc
free
_onexit
__dllonexit
__security_error_handler
__CppXcptFilter
_adjust_fdiv
memset
_initterm
kernel32
GetTempPathA
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
DeleteCriticalSection
InitializeCriticalSection
CreateMutexA
GetCurrentProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateThread
GetSystemDirectoryA
CreateProcessA
GlobalMemoryStatus
OpenProcess
TerminateProcess
TerminateThread
CloseHandle
GetProcessHeap
HeapAlloc
GetTickCount
GetCurrentProcessId
GetVersionExA
ExitProcess
GetLastError
Sleep
ExitThread
user32
wsprintfA
ExitWindowsEx
advapi32
AdjustTokenPrivileges
OpenServiceA
LookupPrivilegeValueA
DeleteService
OpenProcessToken
OpenSCManagerA
urlmon
URLDownloadToFileA
ws2_32
inet_addr
setsockopt
WSASocketA
WSAStartup
htons
WSACleanup
closesocket
gethostbyname
ntohl
WSAGetLastError
gethostname
connect
send
socket
inet_ntoa
recv
__WSAFDIsSet
shutdown
sendto
htonl
Sections
.text Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 242KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ