Static task
static1
Behavioral task
behavioral1
Sample
6fc939e2a227d88e4de825e6e753bc1f_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6fc939e2a227d88e4de825e6e753bc1f_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6fc939e2a227d88e4de825e6e753bc1f_JaffaCakes118
-
Size
72KB
-
MD5
6fc939e2a227d88e4de825e6e753bc1f
-
SHA1
626bedbae8bde106b07a216f997f03a4575d61ee
-
SHA256
50f6e82511d287759798d0d999350448266152d5d7ad70cb32b0ab32451e81ca
-
SHA512
86e7e6ad7ae7cfd05bd335b6018a2e51c2a64b116af72e5209a963f30ac5672ba71e304135dabfc9d75c52dad56e50414fa5bc8a5b11d6e8c7bf3cfd3022ed40
-
SSDEEP
1536:sXJ5SgVABVkRO8Y5+KDHbct1MmjL6yswLfClpl:sXJMDARl3Mcswejl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6fc939e2a227d88e4de825e6e753bc1f_JaffaCakes118
Files
-
6fc939e2a227d88e4de825e6e753bc1f_JaffaCakes118.dll windows:4 windows x86 arch:x86
0c6c576ec5ff936216477f18c8aa1600
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetTimeFormatA
GetTimeZoneInformation
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LocalAlloc
LocalFree
OpenProcess
VirtualAllocEx
VirtualFreeEx
WideCharToMultiByte
WriteFile
WriteProcessMemory
lstrcatA
lstrcpyA
lstrlenA
GetTickCount
HeapFree
GetProcessHeap
GetModuleHandleA
Sleep
lstrcpynA
GetProcAddress
LoadLibraryA
DeleteFileA
LeaveCriticalSection
EnterCriticalSection
CreateThread
InitializeCriticalSection
GetWindowsDirectoryA
Process32Next
TerminateProcess
Process32First
CreateToolhelp32Snapshot
ExitThread
HeapSize
LCMapStringW
GetLocalTime
GetDateFormatA
CreateRemoteThread
CreateFileA
HeapAlloc
CloseHandle
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
SetEndOfFile
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetCPInfo
GetOEMCP
GetACP
FlushFileBuffers
SetStdHandle
InterlockedExchange
RtlUnwind
VirtualQuery
GetSystemInfo
VirtualProtect
MultiByteToWideChar
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetCurrentProcess
ExitProcess
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
GetLastError
ReadFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
user32
FindWindowA
GetWindowThreadProcessId
wsprintfA
CharUpperA
advapi32
RegOpenKeyA
RegEnumKeyExA
RegCloseKey
IsTextUnicode
RegQueryValueExA
ole32
CreateStreamOnHGlobal
GetHGlobalFromStream
shlwapi
PathFileExistsA
StrStrIA
StrStrA
wsock32
gethostbyname
socket
htonl
send
closesocket
ntohs
htons
sendto
connect
inet_addr
gethostbyaddr
getsockname
recv
WSAStartup
ioctlsocket
select
wininet
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
FindCloseUrlCache
DeleteUrlCacheEntryA
InternetGetConnectedState
urlmon
URLDownloadToFileA
Sections
.text Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ