Static task
static1
Behavioral task
behavioral1
Sample
602be6fd3e8a1e7324fbaad69da7c9be_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
602be6fd3e8a1e7324fbaad69da7c9be_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
602be6fd3e8a1e7324fbaad69da7c9be_JaffaCakes118
-
Size
28KB
-
MD5
602be6fd3e8a1e7324fbaad69da7c9be
-
SHA1
84d5061944a393b85ab2818517518cbb0e07fb70
-
SHA256
ca7620c3c4fc421f8372d55df263cbd13db762d1de7751890bf5b60721a34180
-
SHA512
81cd953d96f7988e7087ca65604d74a809f51231a7597db7f7af463a4104e318bb9425b338f93209ce49b4e83607c26399655b8c197a6d2856a47f923d5f150b
-
SSDEEP
384:/R9zprFCnhkocOpIsoJwuGTLTBwuT/DhKt4KHzjMNu:ZRRo7pVoJwuGTLTBwuT/DhKt4tNu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 602be6fd3e8a1e7324fbaad69da7c9be_JaffaCakes118
Files
-
602be6fd3e8a1e7324fbaad69da7c9be_JaffaCakes118.dll windows:4 windows x86 arch:x86
1c99222ee9750dcc88f23b46ea3f79ef
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
closesocket
ntohs
ntohl
msvcrt
memcmp
strchr
free
atoi
malloc
_itoa
memcpy
strncpy
strcmp
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
_initterm
_adjust_fdiv
kernel32
Sleep
GetCommandLineA
ExitProcess
GetModuleHandleA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
CreateThread
Sections
.text Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ