Static task
static1
Behavioral task
behavioral1
Sample
d0f0e285560b17cc829686fc0925daac_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d0f0e285560b17cc829686fc0925daac_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d0f0e285560b17cc829686fc0925daac_JaffaCakes118
-
Size
32KB
-
MD5
d0f0e285560b17cc829686fc0925daac
-
SHA1
8b2ab7aa9db576857c761a13ba461ee1cac53c20
-
SHA256
5d3f30dde0abba864238a99544049189d9ffc9ef86d4ca23c22746d3f6648cbb
-
SHA512
9dff241a762ebbcefd7d002d209b5d4d2ae1c98442e4b3ee777eca14db18f844b60ac2734ba0883cd9ffb3cb3f9c758a439c499d7c461ae4898d0594e39a4197
-
SSDEEP
768:lN5LTvvjt+dr/sl+Y151p80WKd8yGuwCNbKiKZmzaYV:lrLTvvjEd4lN151p83BWeiKTQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d0f0e285560b17cc829686fc0925daac_JaffaCakes118
Files
-
d0f0e285560b17cc829686fc0925daac_JaffaCakes118.dll windows:4 windows x86 arch:x86
b4ab1cf79437c50a16f6ecffbad9723b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord1158
ord924
ord858
ord535
ord2846
ord537
ord2915
ord825
ord540
ord860
ord2764
ord1168
ord6648
ord4129
ord800
ord823
msvcrt
_adjust_fdiv
_initterm
free
malloc
printf
strncmp
exit
strncpy
strstr
strchr
atoi
rand
srand
sprintf
__CxxFrameHandler
time
_strcmpi
kernel32
GetModuleHandleA
GetProcAddress
OpenProcess
VirtualAllocEx
WriteProcessMemory
Process32Next
TerminateProcess
CloseHandle
Sleep
lstrlenA
ExitThread
WinExec
Process32First
CreateToolhelp32Snapshot
TerminateThread
CreateRemoteThread
CreateProcessA
UnmapViewOfFile
CreateMutexA
CreateFileMappingA
GetLastError
MapViewOfFile
WaitForSingleObject
ReleaseMutex
GetVersionExA
GlobalMemoryStatus
GetSystemDirectoryA
CreateThread
user32
wsprintfA
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
urlmon
URLDownloadToFileA
ws2_32
connect
inet_addr
htons
socket
WSAStartup
closesocket
recv
WSAGetLastError
__WSAFDIsSet
select
gethostbyname
send
winmm
timeGetTime
Sections
.text Size: - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.delete Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.pklstb Size: 26KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.relo2 Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ