InitModule
Static task
static1
Behavioral task
behavioral1
Sample
c1d3842ced90247148b001100d6415cb_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c1d3842ced90247148b001100d6415cb_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c1d3842ced90247148b001100d6415cb_JaffaCakes118
-
Size
80KB
-
MD5
c1d3842ced90247148b001100d6415cb
-
SHA1
a07a1e4b560cdeaf37545ad4781c7428180e4f6e
-
SHA256
c9ce72ec15dabc78a56278ea25195eca2315b39027ecbf3a6c6b92cbef29b619
-
SHA512
1402fc74749724707d5a8c5d4d9bdb8885fea2acdf18e53b0939f5f96ac74535015330cb77e14d1b1c15ea110a192bebb1deee3281cc32d2d106d7151eca127f
-
SSDEEP
1536:/ZavIdIYg9Z4CfqkKABhXQhC7X9nw3np67MYnt7I0zD7bT:/ZavIdIYqavAXcC7tw3n6u0zDHT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c1d3842ced90247148b001100d6415cb_JaffaCakes118
Files
-
c1d3842ced90247148b001100d6415cb_JaffaCakes118.dll windows:4 windows x86 arch:x86
69837ffca60fe779af8e20d5b873e5e5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpyA
DeleteFileA
CloseHandle
ReadFile
GetFileSize
CreateFileA
lstrlenA
lstrcpynA
Sleep
lstrcmpA
ExitThread
GetLastError
HeapReAlloc
HeapAlloc
HeapDestroy
GetTempPathA
HeapCreate
WriteFile
lstrcmpiA
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
GetLocalTime
TerminateThread
GetExitCodeThread
WaitForSingleObject
GetVersionExA
FreeLibraryAndExitThread
GetModuleHandleA
GetTempFileNameA
lstrcatA
CreateProcessA
CreateThread
GlobalAlloc
HeapFree
GlobalFree
GetSystemInfo
VirtualProtect
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetLocaleInfoA
VirtualAlloc
VirtualFree
WideCharToMultiByte
GetStdHandle
InitializeCriticalSection
ExitProcess
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
SetLastError
GetProcAddress
TerminateProcess
GetCurrentProcess
LoadLibraryA
InterlockedExchange
VirtualQuery
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
LeaveCriticalSection
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
user32
wsprintfA
advapi32
RegQueryValueExA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
urlmon
URLDownloadToFileA
iphlpapi
GetNetworkParams
GetBestInterface
GetAdaptersInfo
ws2_32
ntohl
setsockopt
sendto
recvfrom
WSAGetLastError
shutdown
WSACleanup
ntohs
socket
gethostbyname
htons
connect
send
select
__WSAFDIsSet
closesocket
recv
WSAStartup
inet_addr
winmm
timeGetTime
Exports
Exports
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ