MailAlertConnect
Static task
static1
Behavioral task
behavioral1
Sample
8545b389bfa697058830d8fb016ee3d1_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8545b389bfa697058830d8fb016ee3d1_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8545b389bfa697058830d8fb016ee3d1_JaffaCakes118
-
Size
64KB
-
MD5
8545b389bfa697058830d8fb016ee3d1
-
SHA1
0e1e9ee75cb6c6024990c8c6b07a7639d1c10cc3
-
SHA256
0a2142efeb54dac577209894e5a0853036944c626332a22800b5316cdac2774c
-
SHA512
14b6fc56161545a342ac352bb006ff03beb57fd1e207599a03caeb6177efc191375c93c006be43819b1e0ce317f75010c763b863d3e792f07327418546eb0d7c
-
SSDEEP
768:6lI9YpIEp51AHqhCQJx2z3MbGWnMWLWHM7iBhaKYVzQtKD:6wYpI+TFhBxLqM7QxKD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8545b389bfa697058830d8fb016ee3d1_JaffaCakes118
Files
-
8545b389bfa697058830d8fb016ee3d1_JaffaCakes118.dll windows:4 windows x86 arch:x86
e9e0aef1d30101544be791d725f6f70e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
setupapi
SetupDiGetClassDevsA
CM_Get_DevNode_Status
SetupDiSetClassInstallParamsA
SetupDiCallClassInstaller
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
mfc42
ord6283
ord540
ord537
ord860
ord1105
ord4129
ord4278
ord3811
ord858
ord6282
ord535
ord2818
ord3663
ord5710
ord939
ord2763
ord1182
ord342
ord800
ord940
ord665
ord1979
ord5442
ord2393
ord3318
ord5186
ord354
ord924
ord541
ord801
ord2820
ord5440
ord6383
ord5450
ord6394
ord823
ord1253
ord1168
ord825
ord941
ord922
ord2764
msvcrt
strstr
strncmp
__dllonexit
_onexit
??1type_info@@UAE@XZ
free
_initterm
malloc
_adjust_fdiv
sscanf
setlocale
memmove
isspace
strncpy
_mbscmp
__CxxFrameHandler
_stricmp
kernel32
Sleep
lstrcmpA
FreeLibrary
GetTimeZoneInformation
LoadLibraryA
SetLastError
GetTickCount
GetLastError
CreateThread
GetProcAddress
user32
SendMessageA
wsock32
gethostname
htons
connect
send
recv
closesocket
select
ioctlsocket
bind
WSASetLastError
socket
WSAStartup
gethostbyname
rpcrt4
RpcStringFreeA
UuidToStringA
UuidCreate
Exports
Exports
Sections
.text Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ