Static task
static1
Behavioral task
behavioral1
Sample
6241d8cf6194ebf20e6d957ef94c96c6_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6241d8cf6194ebf20e6d957ef94c96c6_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6241d8cf6194ebf20e6d957ef94c96c6_JaffaCakes118
-
Size
36KB
-
MD5
6241d8cf6194ebf20e6d957ef94c96c6
-
SHA1
98c4c841862a6297bd512bce1e8c1a644571a0b8
-
SHA256
220c0bb96025e055133d433bb7184d3e28a5d67e3a03b47e651a82f037a52d86
-
SHA512
00ac76cef6df4bcf17506c6ec7d205812af0a62dd863e1468eba31e4ee9f71428ad6038b9083241925bc4cd696d979ae897a03a14dbed0f0fbef33e894fba259
-
SSDEEP
768:EGC6nNfdEaO+x0O4XzZp1Bc2iTjikjL3m:LdEaOlBc2iTjikjL3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6241d8cf6194ebf20e6d957ef94c96c6_JaffaCakes118
Files
-
6241d8cf6194ebf20e6d957ef94c96c6_JaffaCakes118.dll windows:4 windows x86 arch:x86
e726ee8f19737d6c0d9f6029945a9acc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord6648
ord4129
ord5710
ord926
ord924
ord922
ord537
ord2846
ord2764
ord2915
ord540
ord535
ord858
ord6663
ord860
ord4278
ord1168
ord800
ord2818
ord939
ord6877
msvcrt
_adjust_fdiv
malloc
_initterm
free
strstr
strncmp
strchr
strtok
exit
atoi
rand
srand
_mbscmp
printf
__CxxFrameHandler
time
kernel32
ExitThread
LoadLibraryA
GetProcAddress
Sleep
GetVersionExA
GlobalMemoryStatus
CreateToolhelp32Snapshot
GetCurrentProcessId
OpenProcess
GetModuleHandleA
CreateProcessA
GetSystemDirectoryA
CreateThread
GetCurrentProcess
ExitProcess
GetTickCount
GetProcessHeap
CloseHandle
TerminateThread
Process32Next
HeapAlloc
TerminateProcess
CreateMutexA
GetLastError
Process32First
user32
ExitWindowsEx
wsprintfA
advapi32
OpenServiceA
OpenSCManagerA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
DeleteService
urlmon
URLDownloadToFileA
ws2_32
inet_ntoa
htonl
gethostbyname
closesocket
connect
htons
inet_addr
socket
send
WSAGetLastError
recv
__WSAFDIsSet
select
WSAStartup
sendto
setsockopt
WSASocketA
gethostname
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 808B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ