Static task
static1
Behavioral task
behavioral1
Sample
5e9b9df6754d64d6c4e9069ddba5dd49_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5e9b9df6754d64d6c4e9069ddba5dd49_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5e9b9df6754d64d6c4e9069ddba5dd49_JaffaCakes118
-
Size
34KB
-
MD5
5e9b9df6754d64d6c4e9069ddba5dd49
-
SHA1
010faaa6128e91bcb8382c5474048c6b05271a88
-
SHA256
44c7a0d74630f3b05e75de058793088ba140ecdd4654e2873c3830ecc13358fe
-
SHA512
567de4d057aa870eec2685f03e993903c6a4c9612e037dfd1a866fcd352ec4ecc5b4462466af08ad77587ef10f981e1adc4cc9755f31a539405cf780e6cdb55b
-
SSDEEP
768:xFC8HiNvBkIDvfxymuyto2UkxCyzKGquduNFisW1:XNiNvBkO0muyez9y+Gr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e9b9df6754d64d6c4e9069ddba5dd49_JaffaCakes118
Files
-
5e9b9df6754d64d6c4e9069ddba5dd49_JaffaCakes118.dll windows:4 windows x86 arch:x86
fd3c66ef2c32158d30642df50dc4f311
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord1158
ord924
ord858
ord535
ord2846
ord537
ord2915
ord825
ord540
ord1168
ord860
ord2764
ord6648
ord4129
ord800
ord823
msvcrt
_adjust_fdiv
_initterm
free
malloc
printf
strncmp
exit
strncpy
srand
time
rand
sprintf
strstr
strchr
atoi
__CxxFrameHandler
_strcmpi
kernel32
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
TerminateProcess
OpenProcess
WaitForSingleObject
lstrlenA
CreateThread
Sleep
GetProcAddress
GetModuleHandleA
CreateProcessA
Process32Next
Process32First
CreateToolhelp32Snapshot
CloseHandle
CreateEventA
UnmapViewOfFile
CreateMutexA
CreateFileMappingA
GetLastError
MapViewOfFile
ReleaseMutex
GetCurrentProcess
GetVersionExA
GlobalMemoryStatus
GetSystemDirectoryA
ExitThread
WinExec
user32
wsprintfA
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSetValueExA
urlmon
URLDownloadToFileA
ws2_32
recv
closesocket
send
connect
inet_addr
WSAStartup
htons
WSAGetLastError
__WSAFDIsSet
select
gethostbyname
socket
winmm
timeGetTime
Sections
.text Size: - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.delete Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.pklstb Size: 27KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.relo2 Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ