ImportFunction
Static task
static1
Behavioral task
behavioral1
Sample
63f53200b7c6fd512885688b77bea338_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
63f53200b7c6fd512885688b77bea338_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
63f53200b7c6fd512885688b77bea338_JaffaCakes118
-
Size
120KB
-
MD5
63f53200b7c6fd512885688b77bea338
-
SHA1
7e277384bb7371296498b7cec127d7915ef916b3
-
SHA256
6fa6eb8752e3c744f37d70e0be24552c6102caf8a604e760c229e27cb6d778a8
-
SHA512
13af56fefdc374acc605cf1b9ffe4d0153721b39dec39b507e90f65c11fb79607c03a058275cfc93ec7e167baef1372211b0be250d3a0f4d990c914f6482e602
-
SSDEEP
3072:TD36IHZ/aIS4jEZmMF0+IF5HUVtDP0Ey3mCgmNyPlbV0:iwZ/aIS4jEZmMF0+q6S3HNAV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 63f53200b7c6fd512885688b77bea338_JaffaCakes118
Files
-
63f53200b7c6fd512885688b77bea338_JaffaCakes118.dll windows:4 windows x86 arch:x86
0006488bb7fb5b36a9e5769614dc047f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
WSAStartup
WSACleanup
closesocket
send
recv
connect
WSAGetLastError
gethostbyname
gethostname
htons
select
WSAEventSelect
ioctlsocket
socket
setsockopt
inet_ntoa
shlwapi
wnsprintfA
StrTrimA
StrCmpW
StrStrW
StrStrA
StrStrIA
SHSetValueA
StrCmpNIA
SHGetValueA
PathFindFileNameA
StrToIntA
StrCmpNA
kernel32
GetACP
GetOEMCP
VirtualAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
LoadLibraryA
SetFilePointer
GetSystemTimeAsFileTime
FlushFileBuffers
SetStdHandle
LCMapStringW
LCMapStringA
GetSystemInfo
lstrlenA
GetFileAttributesA
lstrcmpiA
lstrcatA
lstrcpyA
GetVersionExA
HeapAlloc
GetProcessHeap
HeapFree
lstrcpynA
GetModuleFileNameA
LeaveCriticalSection
GetTickCount
InterlockedExchange
EnterCriticalSection
InterlockedIncrement
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
Sleep
InitializeCriticalSection
InterlockedDecrement
GlobalMemoryStatus
DisableThreadLibraryCalls
LocalFree
LocalAlloc
TerminateThread
ResumeThread
CreateMutexA
CreateThread
MultiByteToWideChar
lstrlenW
GetLastError
RtlUnwind
RaiseException
ExitProcess
GetCurrentThreadId
GetCommandLineA
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
HeapReAlloc
TerminateProcess
GetCurrentProcess
HeapSize
VirtualQuery
DeleteCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
GetStringTypeA
GetStringTypeW
GetCPInfo
GetLocaleInfoA
VirtualProtect
user32
ShowWindow
SetWindowLongA
GetWindowLongA
IsWindow
wsprintfA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegDeleteValueA
GetUserNameA
RegFlushKey
RegEnumValueA
RegCloseKey
ole32
CoInitialize
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
VariantClear
VariantInit
Exports
Exports
Sections
.text Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ