WSPStartup
Static task
static1
Behavioral task
behavioral1
Sample
60567f6d8af2a5619330996e0ab18fae_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
60567f6d8af2a5619330996e0ab18fae_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
60567f6d8af2a5619330996e0ab18fae_JaffaCakes118
-
Size
38KB
-
MD5
60567f6d8af2a5619330996e0ab18fae
-
SHA1
7d966808204f5b790bac26cbc7ffcf1cfba1268d
-
SHA256
8c8e00961b71a200112c84947185b3c6d612e93104c99758aca3d7559ea07315
-
SHA512
848faa03f81a380c021dade87eb4bc7a67a613ca83106109c59d97708a892073129b148519168c4801a58b4030ca6a9dac9d40e1bc2b0210c23a9dec24cd4c7f
-
SSDEEP
192:Iexpfk0sinZTbbgllXrzB4nZUUsrjrmM+oVO5fcYUhYWyWAlDLKxBFIh30w:Jdk0zbUllbdKI6Msfc5hRyWAlDG3F8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 60567f6d8af2a5619330996e0ab18fae_JaffaCakes118
Files
-
60567f6d8af2a5619330996e0ab18fae_JaffaCakes118.dll windows:4 windows x86 arch:x86
32e072e958de25a247ef2bce0491eec3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
WSAGetLastError
WSACleanup
select
shutdown
gethostbyname
htons
inet_addr
closesocket
getsockname
inet_ntoa
send
recv
WSAStartup
socket
connect
mfc42
ord535
ord860
ord800
ord802
ord540
ord542
ord3337
ord3811
ord1158
ord825
ord858
ord537
ord1085
ord823
ord2915
msvcrt
_beginthreadex
__CxxFrameHandler
atoi
getchar
_splitpath
fclose
fread
rewind
ftell
fseek
fopen
printf
strstr
__dllonexit
_onexit
free
_initterm
malloc
_adjust_fdiv
exit
time
sprintf
fwrite
_fcloseall
_mkdir
kernel32
GetModuleFileNameA
GetVersionExA
GetModuleHandleA
LoadLibraryA
GetProcAddress
TerminateThread
TerminateProcess
CreatePipe
CreateProcessA
CloseHandle
WriteFile
PeekNamedPipe
ReadFile
GetSystemDirectoryA
GetCurrentDirectoryA
CreateThread
Sleep
GetLocaleInfoA
GetLastError
Exports
Exports
Sections
.text Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ