NSGetModule
Static task
static1
Behavioral task
behavioral1
Sample
b45bac6b8fb3235e5ff329843c1b91e7_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b45bac6b8fb3235e5ff329843c1b91e7_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b45bac6b8fb3235e5ff329843c1b91e7_JaffaCakes118
-
Size
352KB
-
MD5
b45bac6b8fb3235e5ff329843c1b91e7
-
SHA1
1ad88ce245b391e7fa17644cb83fa48cd9e5087e
-
SHA256
2ca865caf30945706fa03089dd2c19a572e00baa03a8db146794a6c43fb1c357
-
SHA512
e890b2575498e010a402328f82f58613cb0a9cc07fca04a511fd6b12095741d2f5bfc851e9205880b3c52cced934f79106b1604d4c96c2ceef4f1fbfcf4509d0
-
SSDEEP
6144:TMzGFUxKqqNta5d/ZnQNkG0S4SGN5ovz:NeKNud/RG4S2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b45bac6b8fb3235e5ff329843c1b91e7_JaffaCakes118
Files
-
b45bac6b8fb3235e5ff329843c1b91e7_JaffaCakes118.dll windows:4 windows x86 arch:x86
d9c757981a9f8d0bd970d7981c32838f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalAlloc
GlobalFree
GetModuleHandleW
GetModuleFileNameW
LoadLibraryW
GetProcAddress
GetTempPathW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
GetLastError
Sleep
DebugBreak
InterlockedIncrement
MultiByteToWideChar
lstrlenA
lstrlenW
InterlockedDecrement
OutputDebugStringW
SetEvent
CreateThread
WaitForMultipleObjects
CreateEventW
GetExitCodeThread
ResetEvent
ExitThread
TerminateThread
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
WideCharToMultiByte
HeapFree
GetProcessHeap
GetVersionExW
GetFileAttributesW
FreeLibrary
LoadLibraryA
CloseHandle
CreateDirectoryW
GetModuleHandleA
GetCurrentProcess
OutputDebugStringA
FormatMessageW
GetVersion
GetSystemInfo
SetLastError
GetTickCount
CreateMutexW
ReleaseMutex
GetModuleFileNameA
IsBadReadPtr
OpenFile
RemoveDirectoryW
RtlUnwind
HeapAlloc
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
HeapReAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
WriteFile
GetStdHandle
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
SetHandleCount
GetFileType
GetStartupInfoA
VirtualQuery
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
HeapSize
SetFilePointer
ReadFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
SetStdHandle
CreateFileW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
user32
UnregisterClassA
GetSystemMetrics
wvsprintfW
CharNextW
wsprintfW
LoadStringW
advapi32
RegSetValueExW
RegCreateKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
shell32
SHGetFolderPathW
oleaut32
VariantClear
SysFreeString
SysAllocString
SysStringLen
shlwapi
UrlGetPartW
wininet
InternetCloseHandle
HttpQueryInfoW
HttpSendRequestW
InternetOpenW
InternetConnectW
HttpOpenRequestW
xpcom
NS_GetServiceManager
NS_CStringGetData
NS_StringContainerInit
NS_StringContainerFinish
NS_StringGetData
NS_CStringContainerFinish
NS_CStringSetData
NS_CStringContainerInit
NS_CStringContainerInit2
NS_Free
NS_Alloc
nspr4
PR_AtomicDecrement
PR_AtomicIncrement
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
urlmon
URLDownloadToFileW
Exports
Exports
Sections
.text Size: 144KB - Virtual size: 143KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.smiley Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 728B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.oex Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE