Static task
static1
Behavioral task
behavioral1
Sample
bff1bfdbff3d573d00bdc36fc0b0789c_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bff1bfdbff3d573d00bdc36fc0b0789c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bff1bfdbff3d573d00bdc36fc0b0789c_JaffaCakes118
-
Size
36KB
-
MD5
bff1bfdbff3d573d00bdc36fc0b0789c
-
SHA1
0c6305a8d387ed6c7fb4732178d22c2b467fea32
-
SHA256
9e67049c4c52b5b8d768cc0fd550f90bdf9c19781b6561cd53563b6bafcc9898
-
SHA512
30ff45f0039f03f77e306c2532720d06773aa204fd496dd092aebe15700437707039964398acccd31249c5693c34261265135993aefa172ae63ef21e8e1bff19
-
SSDEEP
384:ads8OSvmBYKvgh1sUIRb8wW2EQ2V+UfnGX59+Mdo7fcQFmwhlKWnIjy5hXeX:adUSvmBYKINOJEfVMfd8fcQFm/jmXe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bff1bfdbff3d573d00bdc36fc0b0789c_JaffaCakes118
Files
-
bff1bfdbff3d573d00bdc36fc0b0789c_JaffaCakes118.dll windows:4 windows x86 arch:x86
4cd0c251d0ca79623793bada01931e8a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord6648
ord4129
ord5710
ord926
ord924
ord922
ord537
ord2846
ord2764
ord2915
ord540
ord535
ord858
ord6663
ord860
ord4278
ord1168
ord800
ord2818
ord939
ord6877
msvcrt
_adjust_fdiv
malloc
_initterm
free
strstr
strncmp
strchr
strtok
exit
atoi
rand
srand
_mbscmp
printf
__CxxFrameHandler
time
kernel32
GetVersionExA
GlobalMemoryStatus
LoadLibraryA
GetProcAddress
Sleep
OpenProcess
CreateProcessA
ExitThread
CreateThread
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
ExitProcess
GetLastError
GetCurrentProcessId
HeapAlloc
GetProcessHeap
CloseHandle
TerminateThread
GetTickCount
GetSystemDirectoryA
CreateMutexA
TerminateProcess
user32
ExitWindowsEx
wsprintfA
advapi32
OpenServiceA
OpenSCManagerA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
DeleteService
urlmon
URLDownloadToFileA
ws2_32
inet_ntoa
htonl
closesocket
WSAGetLastError
recv
__WSAFDIsSet
send
select
connect
socket
inet_addr
htons
WSAStartup
gethostbyname
sendto
setsockopt
WSASocketA
gethostname
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 808B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ