Update
Static task
static1
Behavioral task
behavioral1
Sample
65f563a40b4e326d9a5ac18905860824_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
65f563a40b4e326d9a5ac18905860824_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
65f563a40b4e326d9a5ac18905860824_JaffaCakes118
-
Size
40KB
-
MD5
65f563a40b4e326d9a5ac18905860824
-
SHA1
8c49ace9ee387682f7004391208c75b27b671b19
-
SHA256
92528235ddc3e53f73aa578aedbcb927d0713f9940b9d31ae3fc31ffe75e9e6b
-
SHA512
9be85ff559063272d5ef8e92be1d759b3695ccc16f33cb4614da74641bebb1020ecbe224a94d49aa173adfc9e6fe24ed99d3eb456f7338a85d8bc7479b3d8ba4
-
SSDEEP
384:Bo09w2xENzefHJvAPrYcDmpCFoMxp9ftJ8px8WAnQJbCo3awlBmyNoiJ:BL66fJaXD2goSv8px8WFBmy3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 65f563a40b4e326d9a5ac18905860824_JaffaCakes118
Files
-
65f563a40b4e326d9a5ac18905860824_JaffaCakes118.dll windows:4 windows x86 arch:x86
c6aacb4256f8d555bd6b8c5ddb2f0a34
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
RtlImageNtHeader
RtlImageDirectoryEntryToData
strchr
strtoul
ZwOpenFile
ZwClose
strncpy
_wcslwr
strstr
_wcsnicmp
_strlwr
_strnicmp
sprintf
memcpy
memset
imagehlp
MapFileAndCheckSumA
wininet
InternetCrackUrlA
InternetConnectA
InternetCheckConnectionA
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetReadFile
InternetCloseHandle
ws2_32
accept
listen
send
closesocket
socket
bind
connect
recv
WSAStartup
inet_addr
htons
shutdown
inet_ntoa
kernel32
DeleteFileA
GetTempPathA
VirtualProtect
GetModuleHandleA
LoadLibraryA
GetTempFileNameA
ReadFile
MoveFileExA
SetFilePointer
GetFileSize
CreateFileA
CreateThread
CloseHandle
WinExec
GlobalFree
DisableThreadLibraryCalls
EnterCriticalSection
VirtualAlloc
GetLastError
MultiByteToWideChar
GetSystemDirectoryA
LeaveCriticalSection
Sleep
GetModuleFileNameA
TerminateThread
WideCharToMultiByte
GlobalAlloc
InitializeCriticalSection
GetCommandLineA
WriteFile
VirtualFree
InterlockedDecrement
InterlockedIncrement
CreateMutexA
advapi32
RegCloseKey
RegOpenKeyA
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
Exports
Exports
Sections
.text Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ