Static task
static1
Behavioral task
behavioral1
Sample
a6638f0118b49ef4976318c7462e66f6_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a6638f0118b49ef4976318c7462e66f6_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a6638f0118b49ef4976318c7462e66f6_JaffaCakes118
-
Size
14KB
-
MD5
a6638f0118b49ef4976318c7462e66f6
-
SHA1
79873d1b766fd26fbc0e9e47d241d77bc40056b8
-
SHA256
94aef61d68fdaf99ff776e14980c2a555dd15e6fe4cecd2fd04ee6ac043c5c8d
-
SHA512
9d4090cd18b8f13d8523dbd8a1f826f192f1a534ba54dab2c330d41cfe22af68fe0fca4732a3d1af2e9cda6a017794d6ffe4033d299ab08d3f50a8d93c7d0f01
-
SSDEEP
384:iLTAw2keiWcmrX61XNSzXFbumfnF3XnRKLs:ixWX6DSbpum/F3BK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a6638f0118b49ef4976318c7462e66f6_JaffaCakes118
Files
-
a6638f0118b49ef4976318c7462e66f6_JaffaCakes118.dll windows:5 windows x86 arch:x86
cfca7d97465134750523ce42ad68b04d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
ioctlsocket
connect
WSAStartup
inet_addr
WSAGetLastError
htons
ntohs
getsockname
recv
bind
socket
closesocket
gethostbyname
send
listen
accept
kernel32
GetSystemDirectoryA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
lstrcpyA
CreateThread
DeleteFileA
LocalFree
GetTempPathA
CloseHandle
GetVersionExA
LoadLibraryExA
GetModuleHandleA
WritePrivateProfileStringA
CreateFileA
lstrcmpA
lstrlenA
lstrcpynA
GetTickCount
WriteFile
Sleep
CreateProcessA
RtlUnwind
lstrcatA
GetLastError
lstrcmpiA
GetProcAddress
GetTempFileNameA
GetPrivateProfileStringA
LocalAlloc
Sections
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 810B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ