C:\Development\openssl-1.0.0a-x32\out32dll\libeay32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b36a633e1750002ae9bc7350a888696f_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b36a633e1750002ae9bc7350a888696f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b36a633e1750002ae9bc7350a888696f_JaffaCakes118
-
Size
1.1MB
-
MD5
b36a633e1750002ae9bc7350a888696f
-
SHA1
f0ac9a5d416595639cde0e07507d16c4458c3fd2
-
SHA256
e89d540f6cd2b37fc50d2c5c717a14a7432dec28b54dbbb2a51bea9899708f95
-
SHA512
c7cd93c65129fd2df8bffc6904626188f597b539e57500a162e5d9f155c82d8c53147be3e3bfce6dac3d69d0a0e3be6c61fa170e2ab067c544a086387b60ef01
-
SSDEEP
24576:WnOEAVhxiLq8851YSsUE1pMQur54irOg3epVWe2u54:WC08PsUE1pHur5nBupVWe2uO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b36a633e1750002ae9bc7350a888696f_JaffaCakes118
Files
-
b36a633e1750002ae9bc7350a888696f_JaffaCakes118.dll windows:5 windows x86 arch:x86
8a74fccac467f58f95c3bd4623ed084f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ws2_32
sendto
recvfrom
bind
listen
accept
ntohl
ioctlsocket
WSACleanup
WSAStartup
gethostbyname
getsockopt
getservbyname
ntohs
htons
htonl
socket
setsockopt
connect
send
WSASetLastError
recv
WSAGetLastError
shutdown
closesocket
gdi32
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
GetObjectA
BitBlt
GetBitmapBits
DeleteObject
DeleteDC
CreateDCA
advapi32
ReportEventA
DeregisterEventSource
RegisterEventSourceA
user32
MessageBoxA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
kernel32
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
LCMapStringW
LCMapStringA
GetProcessHeap
SetEndOfFile
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
CompareStringA
CreateFileW
CompareStringW
SetEnvironmentVariableA
LoadLibraryW
WriteFile
GetCurrentDirectoryA
GetFullPathNameA
RtlUnwind
FlushFileBuffers
GetConsoleOutputCP
ExitProcess
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
GetLastError
GetVersion
GetFileType
GetStdHandle
FindNextFileA
FindFirstFileA
FindClose
FreeLibrary
LoadLibraryA
CloseHandle
SetLastError
MultiByteToWideChar
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
GetVersionExA
FlushConsoleInputBuffer
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
Sleep
SetConsoleCtrlHandler
HeapFree
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
ReadFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
SetFileAttributesA
GetFileAttributesA
CreateFileA
ReadConsoleInputA
SetConsoleMode
WriteConsoleW
GetModuleFileNameW
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetFilePointer
SetStdHandle
WriteConsoleA
Sections
.text Size: 807KB - Virtual size: 806KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 344KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ