NSGetModule
Static task
static1
Behavioral task
behavioral1
Sample
724de8336bbede9f7b9e1c364ba6dda0_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
724de8336bbede9f7b9e1c364ba6dda0_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
724de8336bbede9f7b9e1c364ba6dda0_JaffaCakes118
-
Size
328KB
-
MD5
724de8336bbede9f7b9e1c364ba6dda0
-
SHA1
74bb03dc7aa5c57bcc705752bd58475de983fee7
-
SHA256
3047a1d7fe674b9a0cac8282688cd4cd1022f6fc2e9bfac34506e32acc2a4325
-
SHA512
a5ca8e6a26c8629c2c0aae740bec14f182f6696bac921b4ad64648ad7a9723a05df1f1e7b45a8838d695e569f1293f636b279682a111257e04e6a7dba6d6a74f
-
SSDEEP
6144:tNhOWQadSCH+bG20vavYZkUOOR2xmjXNZumQzaa9Q:VQCXH+KTvaAZktORtNZumQWa9Q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 724de8336bbede9f7b9e1c364ba6dda0_JaffaCakes118
Files
-
724de8336bbede9f7b9e1c364ba6dda0_JaffaCakes118.dll windows:4 windows x86 arch:x86
6b1db5af98d3447a043c14c3acfcca92
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
xpcom
?Push@nsDeque@@QAEAAV1@PAX@Z
?PeekFront@nsDeque@@QAEPAXXZ
?PopFront@nsDeque@@QAEPAXXZ
?PushFront@nsDeque@@QAEAAV1@PAX@Z
?ObjectAt@nsDeque@@QBEPAXH@Z
?Peek@nsDeque@@QAEPAXXZ
?IsAsciiSpace@nsCRT@@SAHG@Z
?IsAscii@nsCRT@@SAHG@Z
?IsAsciiAlpha@nsCRT@@SAHG@Z
?First@nsAString@@QBEGXZ
?Assign@nsSubstring@@QAEXPBGI@Z
?StringBeginsWith@@YAHABVnsAString@@0ABVnsStringComparator@@@Z
??_7nsDefaultStringComparator@@6B@
?Find@nsString@@QBEHPBDHHH@Z
?SetLength@nsSubstring@@QAEXI@Z
?EnsureMutable@nsSubstring@@IAEXXZ
?Replace@nsSubstring@@QAEXIIPBGI@Z
?strncmp@nsCRT@@SAHPBG0I@Z
?SetCapacity@nsSubstring@@QAEXI@Z
?Trim@nsString@@QAEXPBDHHH@Z
?Equals@nsSubstring@@QBEHABV1@@Z
?Rebind@nsDependentSubstring@@QAEXABVnsSubstring@@II@Z
?assign_from_helper@nsCOMPtr_base@@QAEXABVnsCOMPtr_helper@@ABUnsID@@@Z
??_7nsGetServiceByCID@@6B@
?assign_from_qi@nsCOMPtr_base@@QAEXVnsQueryInterface@@ABUnsID@@@Z
?FindCharInSet@nsString@@QBEHPBDH@Z
?Mid@nsString@@QBEIAAV1@II@Z
?FindChar@nsSubstring@@QBEHGI@Z
?NS_NewUTF8ConverterStream@@YAIPAPAVnsIUnicharInputStream@@PAVnsIInputStream@@H@Z
?CopyUTF8toUTF16@@YAXABVnsACString@@AAVnsAString@@@Z
?AppendUTF16toUTF8@@YAXPBGAAVnsACString@@@Z
?Equals@nsCSubstring@@QBEHPBD@Z
?AssignWithConversion@nsCString@@QAEXPBGH@Z
?assign_with_AddRef@nsCOMPtr_base@@QAEXPAVnsISupports@@@Z
?assign_from_qi_with_error@nsCOMPtr_base@@QAEXABVnsQueryInterfaceWithError@@ABUnsID@@@Z
?Assign@nsCSubstring@@QAEXPBDI@Z
?smprintf_free@nsTextFormatter@@SAXPAG@Z
?smprintf@nsTextFormatter@@SAPAGPBGZZ
?EqualsWithConversion@nsCString@@QBEHPBDHH@Z
?sEmptyBuffer@?$nsCharTraits@D@@2PBDB
?CreateInstance@nsComponentManager@@SAIABUnsID@@PAVnsISupports@@0PAPAX@Z
?Equals@nsCSubstring@@QBEHABV1@@Z
?FindCharInReadable@@YAHGAAV?$nsReadingIterator@G@@ABV1@@Z
?Assign@nsCSubstring@@QAEXABV1@@Z
?Assign@nsSubstring@@QAEXABV1@@Z
?Empty@nsDeque@@QAEAAV1@XZ
??0nsVoidArray@@QAE@XZ
??0nsGetServiceByCID@@QAE@ABUnsID@@PAVnsISupports@@PAI@Z
?Replace@nsSubstring@@QAEXIIABVnsAString@@@Z
?RFindChar@nsString@@QBEHGHH@Z
?CountChar@nsSubstring@@QBEIG@Z
?ForEach@nsDeque@@QBEXAAVnsDequeFunctor@@@Z
?Append@nsAString@@QAEXG@Z
?Append@nsAString@@QAEXABV1@@Z
?EmptyString@@YAABVnsString@@XZ
PL_DHashFinalizeStub
PL_DHashClearEntryStub
PL_DHashMoveEntryStub
PL_DHashStringKey
PL_DHashFreeTable
PL_DHashAllocTable
PL_DHashTableOperate
PL_DHashTableFinish
PL_DHashTableInit
?SetLength@nsCSubstring@@QAEXI@Z
?AssignWithConversion@nsCString@@QAEXABVnsAString@@@Z
?NS_RegisterStaticAtoms@@YAIPBUnsStaticAtom@@I@Z
?strlen@nsCRT@@SAIPBG@Z
?HashCode@nsCRT@@SAIPBGPAI@Z
?strcmp@nsCRT@@SAHPBG0@Z
?Append@nsAString@@QAEXPBG@Z
?Assign@nsSubstring@@QAEXABVnsSubstringTuple@@@Z
?IsAsciiDigit@nsCRT@@SAHG@Z
?ToInteger@nsString@@QBEHPAHI@Z
?StripChar@nsString@@QAEXGH@Z
?InsertObjectAt@nsCOMArray_base@@IAEHPAVnsISupports@@H@Z
??0nsCOMArray_base@@IAE@XZ
??0nsCreateInstanceByContractID@@QAE@PBDPAVnsISupports@@PAI@Z
?Adopt@nsCSubstring@@QAEXPADI@Z
??0nsGetServiceByContractID@@QAE@PBDPAVnsISupports@@PAI@Z
??1nsCOMArray_base@@IAE@XZ
?Assign@nsACString@@QAEXABV1@@Z
PL_DestroyEvent
PL_InitEvent
?AssignWithConversion@nsString@@QAEXPBDH@Z
?Assign@nsCSubstring@@QAEXABVnsACString@@@Z
?FirstThat@nsDeque@@QBEPBXAAVnsDequeFunctor@@@Z
?Equals@nsACString@@QBEHABV1@@Z
?ToLowerCase@@YAXAAVnsCSubstring@@@Z
?CompressWhitespace@nsString@@QAEXHH@Z
?AppendUTF8toUTF16@@YAXABVnsACString@@AAVnsAString@@@Z
?Assign@nsAString@@QAEXABVnsSubstringTuple@@@Z
?CaseInsensitiveFindInReadable@@YAHABVnsACString@@AAV?$nsReadingIterator@D@@1@Z
?FindCharInReadable@@YAHDAAV?$nsReadingIterator@D@@ABV1@@Z
?NS_CreateServicesFromCategory@@YAIPBDPAVnsISupports@@0@Z
?NS_NewGenericModule2@@YAIPAUnsModuleInfo@@PAPAVnsIModule@@@Z
NS_NewLocalFile
??_7nsCreateInstanceByCID@@6B@
?Adopt@nsSubstring@@QAEXPAGI@Z
??_7nsGetServiceByContractID@@6B@
NS_GetServiceManager
?RemoveElement@nsVoidArray@@QAEHPAX@Z
??1nsVoidArray@@UAE@XZ
??0nsAutoVoidArray@@QAE@XZ
?InsertElementAt@nsVoidArray@@QAEHPAXH@Z
?Clear@nsAutoVoidArray@@UAEXXZ
?SizeTo@nsAutoVoidArray@@UAEHH@Z
?Compact@nsAutoVoidArray@@UAEXXZ
?GrowArrayBy@nsVoidArray@@MAEHH@Z
?Equals@nsAString@@QBEHABV1@@Z
?sCanonicalVTable@nsObsoleteACString@@2PBXB
?AppendASCIItoUTF16@@YAXABVnsACString@@AAVnsAString@@@Z
??0nsStringArray@@QAE@H@Z
?InsertStringAt@nsStringArray@@QAEHABVnsAString@@H@Z
??1nsCOMPtr_base@@QAE@XZ
?AppendInt@nsString@@QAEXHH@Z
??1nsStringArray@@UAE@XZ
??1nsACString@@QAE@XZ
?ElementAt@nsVoidArray@@QBEPAXH@Z
?Assign@nsSubstring@@QAEXABVnsAString@@@Z
?Pop@nsDeque@@QAEPAXXZ
?Alloc@nsFixedSizeAllocator@@QAEPAXI@Z
?Init@nsFixedSizeAllocator@@QAEIPBDPBIHHH@Z
??1nsDeque@@QAE@XZ
??0nsDeque@@QAE@PAVnsDequeFunctor@@@Z
?Free@nsFixedSizeAllocator@@QAEXPAXI@Z
?SetLength@nsAString@@QAEXI@Z
?GetWritableBuffer@nsAString@@IAEIPAPAG@Z
??1nsAString@@QAE@XZ
?sEmptyBuffer@?$nsCharTraits@G@@2PBGB
?Length@nsAString@@QBEIXZ
?sCanonicalVTable@nsObsoleteAString@@2PBXB
?CountChar@nsAString@@QBEIG@Z
?GetReadableBuffer@nsAString@@IBEIPAPBG@Z
nspr4
PR_Free
PR_Realloc
PR_Calloc
PR_Malloc
plc4
PL_strcmp
PL_strncmp
plds4
PL_HashTableAdd
PL_NewHashTable
PL_CompareValues
PL_HashTableDestroy
PL_FinishArenaPool
PL_HashTableLookupConst
msvcrt
_initterm
_onexit
__dllonexit
tolower
memcmp
strlen
memset
_purecall
memmove
??2@YAPAXI@Z
free
malloc
memcpy
_adjust_fdiv
kernel32
DisableThreadLibraryCalls
Exports
Exports
Sections
.text Size: 144KB - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE