load
Static task
static1
Behavioral task
behavioral1
Sample
dea8d986d1a46406be8747554face635_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dea8d986d1a46406be8747554face635_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
dea8d986d1a46406be8747554face635_JaffaCakes118
-
Size
40KB
-
MD5
dea8d986d1a46406be8747554face635
-
SHA1
89511aca23a6d7561f219cd0482d020b300174ba
-
SHA256
626902f32c86221acb510420bd89cb6cba578bfd0765629623609d3d10b7b08a
-
SHA512
e383b398cec1b94615fb0baba695ab3623b5cee61130c07da2b945545eadea9fbb929b6094ce1737f3924b23f5f640b9eec05defe967f473d967d60e6646ae1c
-
SSDEEP
768:XRmWB5Mw4dxcst5WNKGDopKia8pEBe+/WzgqGX:XRmWzwxPt5MDRcH+YGX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dea8d986d1a46406be8747554face635_JaffaCakes118
Files
-
dea8d986d1a46406be8747554face635_JaffaCakes118.dll windows:4 windows x86 arch:x86
777bb878f7e521c7e3756b19134d3d1d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
__dllonexit
_adjust_fdiv
_initterm
rand
isgraph
ctime
fopen
fwrite
fclose
localtime
strftime
_except_handler3
time
srand
malloc
free
_strupr
strstr
atoi
sprintf
_onexit
kernel32
GetLogicalDriveStringsA
GetDriveTypeA
GetDiskFreeSpaceExA
GlobalMemoryStatus
GetVersionExA
FreeLibrary
GetModuleFileNameA
GetCurrentProcessId
CreateMutexA
LoadLibraryA
GetVersion
DeleteFileA
CloseHandle
CreateFileA
GetSystemDirectoryA
GetCurrentProcess
TerminateProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
WriteFile
CreateProcessA
ExpandEnvironmentStringsA
ReadFile
GetFileSize
Sleep
CreateThread
GetTickCount
ExitThread
GetCurrentThreadId
TerminateThread
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
GetProcAddress
GetModuleHandleA
VirtualAllocEx
GetLastError
lstrlenA
user32
wsprintfA
RegisterClassA
CreateWindowExA
DefWindowProcA
DestroyWindow
PostQuitMessage
GetMessageA
TranslateMessage
DispatchMessageA
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegOpenKeyExA
RegEnumValueA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
ws2_32
send
sendto
setsockopt
socket
select
getsockname
WSAStartup
__WSAFDIsSet
accept
listen
bind
WSAGetLastError
inet_ntoa
ntohs
gethostname
connect
closesocket
htons
inet_addr
gethostbyname
recv
ioctlsocket
wininet
InternetOpenUrlA
InternetReadFile
InternetOpenA
InternetConnectA
FtpPutFileA
InternetCloseHandle
Exports
Exports
Sections
.text Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ