InjectToProcess
Static task
static1
Behavioral task
behavioral1
Sample
dc965eed67e29f7a414238b11ff4979f_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dc965eed67e29f7a414238b11ff4979f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
dc965eed67e29f7a414238b11ff4979f_JaffaCakes118
-
Size
25KB
-
MD5
dc965eed67e29f7a414238b11ff4979f
-
SHA1
082d886c17d670916fb2b36acadb4892d2fb9ca3
-
SHA256
998794897ba76d57de2734b20ebb5d3d20bafb8295b02cc691e46dd63ebfd68f
-
SHA512
2550a6d2ee375968e5c25037ca7bf33e1de5827c17fe624d665b95d8843281e6f3986626bd913fe0b5e34147b2062b2049f9462c95d163ad5a4ffc50f2885d96
-
SSDEEP
768:bph6yxee1j6NZ7my6+CS4lse9Ysn6GD6QLZI5:bpHxeumv2se9Ys6cBLZI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc965eed67e29f7a414238b11ff4979f_JaffaCakes118
Files
-
dc965eed67e29f7a414238b11ff4979f_JaffaCakes118.dll windows:4 windows x86 arch:x86
5ef97d6153cecc825d222c3f34db0130
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
bind
getpeername
accept
setsockopt
ntohs
socket
shutdown
WSAGetLastError
__WSAFDIsSet
select
inet_addr
WSAStartup
gethostbyname
inet_ntoa
htons
closesocket
user32
wsprintfA
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetTokenInformation
InitializeSecurityDescriptor
wininet
InternetQueryDataAvailable
HttpQueryInfoA
InternetCloseHandle
msvcrt
_strnicmp
_initterm
free
atoi
isspace
malloc
sprintf
fputs
sscanf
_ftol
floor
time
fgets
fclose
strstr
strchr
fopen
_adjust_fdiv
kernel32
HeapDestroy
HeapCreate
HeapValidate
ExitProcess
GetModuleFileNameA
InitializeCriticalSection
EnterCriticalSection
SetUnhandledExceptionFilter
CopyFileA
SetFileAttributesA
CreateThread
LoadLibraryA
lstrcpynA
lstrcmpiA
Sleep
HeapAlloc
HeapFree
LeaveCriticalSection
CreateToolhelp32Snapshot
WriteFile
DeleteFileA
GetSystemDirectoryA
GetFileAttributesA
Process32Next
lstrcpyA
lstrcatA
OpenProcess
Process32First
lstrlenA
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
VirtualFreeEx
CloseHandle
WaitForSingleObject
SetLastError
GetLastError
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetTickCount
GetVersionExA
Exports
Exports
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ