Fire
Static task
static1
Behavioral task
behavioral1
Sample
acd6c209c1bd85d0133538378adcf359_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
acd6c209c1bd85d0133538378adcf359_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
acd6c209c1bd85d0133538378adcf359_JaffaCakes118
-
Size
65KB
-
MD5
acd6c209c1bd85d0133538378adcf359
-
SHA1
c35241405b2635585a19c06f0488604fc9967b17
-
SHA256
d8a2d992d3b7f46709e3c33b364cdd7b09152d27c523cf785041c0686811bfdd
-
SHA512
46ff57b8242ba27f464cc1f9846ce2e233a39c020e7042136d5041d0374b4598615d5dd2afe0715e73cdcabe474176d4578413e941124430db4bd480be079340
-
SSDEEP
1536:yoTcSDDMene4sr2v/OVTqNke54RcnguPhnAiPD62+Ly:yoTlEkbeeKRgguPhn1Phf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource acd6c209c1bd85d0133538378adcf359_JaffaCakes118
Files
-
acd6c209c1bd85d0133538378adcf359_JaffaCakes118.dll windows:4 windows x86 arch:x86
d48c5a197715ea7125ff6e60203fa002
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
longjmp
_setjmp3
_itoa
free
memmove
_purecall
strncmp
atoi
strcmp
_strcmpi
isdigit
_strdup
sscanf
sprintf
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_strlwr
strncpy
memset
memcpy
memcmp
strchr
strstr
strncat
strlen
malloc
??1type_info@@UAE@XZ
_CxxThrowException
strspn
strcspn
tolower
isxdigit
isupper
isspace
ispunct
isprint
islower
isgraph
iscntrl
isalpha
isalnum
strcpy
strcat
advapi32
CryptDeriveKey
CryptGetUserKey
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptGenKey
kernel32
GetComputerNameA
GetVolumeInformationA
UnmapViewOfFile
lstrcpynA
CreateFileMappingA
MapViewOfFile
lstrcmpiA
CreateMutexA
WaitForSingleObject
ReleaseMutex
FlushViewOfFile
Sleep
GetCurrentProcess
VirtualProtect
FlushInstructionCache
LocalFree
MultiByteToWideChar
FreeLibrary
VirtualQuery
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetLastError
GetTickCount
TlsSetValue
TlsGetValue
lstrlenA
GetCurrentProcessId
TlsAlloc
GetProcAddress
LoadLibraryA
TlsFree
GetModuleHandleA
GetModuleFileNameA
CreateThread
CreateEventA
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
TerminateThread
WaitForMultipleObjects
SetEvent
lstrcpyA
SetEndOfFile
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileA
GetWindowsDirectoryA
user32
CallNextHookEx
SetWindowTextA
UpdateWindow
BringWindowToTop
SetForegroundWindow
CharLowerA
FindWindowA
SendMessageA
wsprintfA
EnumWindows
UnhookWindowsHookEx
SetWindowsHookExA
ws2_32
send
recv
closesocket
WSARecv
connect
WSAGetLastError
ntohs
getpeername
WSASend
inet_ntoa
ole32
OleInitialize
CoCreateInstance
OleUninitialize
wininet
InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA
InternetReadFile
InternetOpenA
InternetConnectA
InternetOpenUrlA
HttpQueryInfoA
InternetSetCookieA
InternetGetCookieA
HttpAddRequestHeadersA
InternetQueryOptionA
oleaut32
SysAllocString
VariantClear
SysFreeString
crypt32
CertVerifyCertificateChainPolicy
CertGetCertificateChain
Exports
Exports
Sections
.text Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Shared Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ