StartRouter
Static task
static1
Behavioral task
behavioral1
Sample
e2654ede269f761f84606a9f81d2c142_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e2654ede269f761f84606a9f81d2c142_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
e2654ede269f761f84606a9f81d2c142_JaffaCakes118
-
Size
232KB
-
MD5
e2654ede269f761f84606a9f81d2c142
-
SHA1
ca4f91d13f05123a6928b4fc362d88148fd4c269
-
SHA256
44f631996ccadf7f051b205a00f6f0738c16c389241a98b600e3875099547246
-
SHA512
3e321d7b57e17ae10d30bbdb42d6af9fb00aa9d2ddb0a48edc88e4e04ebcffae5fbfdbded278f719e2665557e2713719bdb5fdb297501f3c47bb3c403229145b
-
SSDEEP
6144:pY05zt/lXP3hP7tIjY05zt/lXP3hP7tIZ:p75zt/t3rA75zt/t3r6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e2654ede269f761f84606a9f81d2c142_JaffaCakes118
Files
-
e2654ede269f761f84606a9f81d2c142_JaffaCakes118.dll windows:4 windows x86 arch:x86
b609eb0ce1946993ba423171afe57aab
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
strrchr
strncmp
strncpy
sprintf
atoi
_errno
_snprintf
exit
strncat
realloc
_beginthreadex
calloc
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
_strnicmp
_strnset
_except_handler3
free
strcat
malloc
strcpy
strcmp
strchr
strlen
memcmp
_CxxThrowException
memmove
strstr
_ftol
ceil
__CxxFrameHandler
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
memset
_strupr
_strrev
winmm
waveInUnprepareHeader
waveInClose
waveOutReset
waveInAddBuffer
waveOutUnprepareHeader
waveOutClose
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInStart
waveOutWrite
waveInStop
waveInReset
ws2_32
closesocket
inet_addr
getsockname
bind
setsockopt
send
WSAStartup
WSACleanup
WSAIoctl
connect
sendto
recvfrom
__WSAFDIsSet
ioctlsocket
getpeername
htons
gethostname
gethostbyname
ntohs
socket
inet_ntoa
select
recv
msvcp60
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
kernel32
DeleteFileA
GetCurrentThreadId
CreateMutexA
SetErrorMode
OpenEventA
ReleaseMutex
LocalSize
GetTickCount
GlobalSize
GlobalUnlock
GlobalAlloc
GlobalLock
GlobalFree
LocalAlloc
LocalFree
Sleep
GetLocalTime
SetFilePointer
lstrlenA
GetCurrentProcess
LocalReAlloc
GetLastError
PeekNamedPipe
GetProcAddress
LoadLibraryA
SetEvent
CreateEventA
CloseHandle
ResumeThread
CreateThread
DeleteCriticalSection
ResetEvent
GetVersionExA
lstrcatA
GetFileSize
CreateFileA
ReadFile
WriteFile
MoveFileA
user32
CreateWindowExA
CloseWindow
GetDC
ReleaseDC
BlockInput
DestroyCursor
GetSystemMetrics
GetClipboardData
OpenClipboard
EmptyClipboard
IsWindow
CloseClipboard
mouse_event
SetCursorPos
WindowFromPoint
SetCapture
keybd_event
EnumWindows
GetKeyState
GetAsyncKeyState
GetForegroundWindow
wsprintfA
TranslateMessage
SendMessageA
GetThreadDesktop
SetThreadDesktop
CloseDesktop
IsWindowVisible
GetWindowThreadProcessId
ExitWindowsEx
GetProcessWindowStation
SetProcessWindowStation
GetCursorInfo
GetCursorPos
SetRect
SetClipboardData
GetDesktopWindow
gdi32
DeleteDC
DeleteObject
CreateDIBSection
SelectObject
BitBlt
CreateCompatibleBitmap
GetDIBits
CreateCompatibleDC
advapi32
CloseServiceHandle
UnlockServiceDatabase
LockServiceDatabase
OpenSCManagerA
StartServiceA
EnumServicesStatusA
RegCloseKey
RegQueryValueA
RegOpenKeyExA
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
CloseEventLog
ClearEventLogA
OpenEventLogA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA
shell32
SHGetFileInfoA
ShellExecuteA
wininet
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
avicap32
capCreateCaptureWindowA
capGetDriverDescriptionA
msvfw32
ICSendMessage
ICSeqCompressFrameEnd
ICCompressorFree
ICClose
ICSeqCompressFrame
ICSeqCompressFrameStart
ICOpen
Exports
Exports
Sections
.text Size: 72KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ