Init_rubyeventmachine
Static task
static1
Behavioral task
behavioral1
Sample
d5511a35c9c7895a8e90965a0d4f4ceb_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d5511a35c9c7895a8e90965a0d4f4ceb_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d5511a35c9c7895a8e90965a0d4f4ceb_JaffaCakes118
-
Size
396KB
-
MD5
d5511a35c9c7895a8e90965a0d4f4ceb
-
SHA1
e698bfb53f3ac0137692f59cafdd6de8de1b0220
-
SHA256
57aa62bd2caedb8a16bd791e547aeedb3368bf06afe145cd2a096d087d034941
-
SHA512
20b1d3280c38fe0b913cb9248d8aff6ad8a8822cdfb23f6570e5738e400581e9ec281086edd72e117f4151c8bd206f4218782ab9bc87cf41011b32316ad544da
-
SSDEEP
12288:W4JrqXl9uHxZecCSx7Bhq0qsE8RT+nFbxspoLP6xHDYIkMk+V0SZEVSJV:W4JeXlTSx7Bhq0qiOrspoLP4DYI5lKM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d5511a35c9c7895a8e90965a0d4f4ceb_JaffaCakes118
Files
-
d5511a35c9c7895a8e90965a0d4f4ceb_JaffaCakes118.dll windows:4 windows x86 arch:x86
bd928de98926e834a2d7874bd3c98571
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
kernel32
AddAtomA
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
FindAtomA
GetAtomNameA
GetLastError
GetTickCount
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
ReleaseSemaphore
SetConsoleCtrlHandler
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
_fdopen
_open
_strdup
__dllonexit
__lc_codepage
__mb_cur_max
_assert
_ctype
_errno
_filelengthi64
_fstati64
_iob
_lseeki64
abort
fclose
fflush
fgetpos
fopen
fputc
fread
free
fsetpos
fwrite
getc
getenv
localeconv
malloc
memchr
memcpy
memmove
memset
putc
rand
setlocale
setvbuf
sprintf
srand
strcmp
strcoll
strcpy
strftime
strlen
strtod
strxfrm
time
ungetc
vfprintf
wcslen
ws2_32
WSAGetLastError
WSAStartup
closesocket
htonl
htons
inet_addr
msvcrt-ruby191
accept@12
bind@12
close
connect@12
fcntl
gethostbyname@4
getpeername@12
getsockname@12
getsockopt@20
listen@8
rb_ary_aref
rb_cObject
rb_const_get
rb_define_class_under
rb_define_const
rb_define_method
rb_define_module
rb_define_module_function
rb_eIOError
rb_eRuntimeError
rb_eval_string
rb_float_new
rb_funcall
rb_hash_aref
rb_int2big
rb_intern2
rb_iv_set
rb_ivar_defined
rb_ivar_get
rb_num2long
rb_num2ulong
rb_obj_alloc
rb_raise
rb_rescue
rb_str_new
rb_string_value_ptr
rb_sys_fail
rb_thread_blocking_region
rb_thread_select
rb_time_new
rb_uint2big
rb_w32_fdisset
rb_w32_fdset
rb_w32_stati64
read
recvfrom@24
ruby_snprintf
select@20
sendto@24
setsockopt@20
shutdown@8
socket@12
strerror
write
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eRuntimeError
rb_eIOError
rb_cObject
rb_cObject
rb_cObject
Exports
Exports
Sections
.text Size: 357KB - Virtual size: 357KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 22KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ