Static task
static1
Behavioral task
behavioral1
Sample
ce4e21a40d630edaee1ac671e3c5bc69_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ce4e21a40d630edaee1ac671e3c5bc69_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ce4e21a40d630edaee1ac671e3c5bc69_JaffaCakes118
-
Size
104KB
-
MD5
ce4e21a40d630edaee1ac671e3c5bc69
-
SHA1
c1d729dc82267cf95773c5cf251f522993b14171
-
SHA256
714c1729581b6cf0addc2c6834d9773ae5914615f0995d5fb17c90f6df055702
-
SHA512
a176a5c42f57fab100128af7c58661ae1e69363ddbd8521265d929903e0874ccb460fb895a029632cadfe0cef5ef43bb5cc83f78e89f3c46f662beeaa512ce4f
-
SSDEEP
1536:5hX/YfTvT1goYIkHb4ijg/LsnDmO8h7bm4i/u56e78PwjW2CA:5F/YfTvT1o+iqLwK17BAuMe78PwS2CA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce4e21a40d630edaee1ac671e3c5bc69_JaffaCakes118
Files
-
ce4e21a40d630edaee1ac671e3c5bc69_JaffaCakes118.dll windows:4 windows x86 arch:x86
a411c34796624d02c44b2274e472a39f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord6663
ord858
ord535
ord540
ord922
ord924
ord926
ord537
ord5710
ord1168
ord4129
ord2915
ord941
ord536
ord3178
ord4058
ord2781
ord668
ord610
ord2770
ord6139
ord287
ord356
ord823
ord860
ord4278
ord800
ord2818
ord939
ord6877
ord825
msvcrt
printf
atoi
rand
srand
time
__CxxFrameHandler
_mbscmp
exit
free
malloc
fclose
_adjust_fdiv
_initterm
strtok
sprintf
fwrite
fopen
_stat
fread
kernel32
HeapAlloc
GlobalUnlock
CreateMutexA
GetLastError
ExitProcess
GetSystemDirectoryA
GetCurrentProcess
GetSystemInfo
GetDiskFreeSpaceExA
GlobalSize
GlobalLock
CreateProcessA
DeleteFileA
LoadLibraryA
GetProcAddress
GetVersionExA
lstrcpyA
GlobalMemoryStatus
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
Process32Next
Sleep
GlobalFree
GlobalReAlloc
GlobalAlloc
CloseHandle
TerminateThread
ExitThread
CreateThread
GetCurrentProcessId
GetTickCount
GetComputerNameA
GetProcessHeap
GetDriveTypeA
user32
IsRectEmpty
ReleaseDC
MessageBoxA
wsprintfA
ExitWindowsEx
GetSystemMetrics
GetDC
gdi32
DeleteObject
DeleteDC
GetObjectA
SelectPalette
RealizePalette
GetDIBits
CreateDCA
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
BitBlt
GetStockObject
advapi32
RegCloseKey
OpenSCManagerA
OpenServiceA
ControlService
RegOpenKeyA
RegDeleteValueA
RegSetValueExA
StartServiceA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueExA
shell32
ShellExecuteA
ws2_32
gethostbyname
closesocket
connect
htons
inet_addr
socket
sendto
inet_ntoa
setsockopt
WSASocketA
WSAStartup
gethostname
htonl
send
WSAGetLastError
recv
__WSAFDIsSet
select
Sections
.text Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data0 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ