NSGetModule
Static task
static1
Behavioral task
behavioral1
Sample
eb882de8948f19a9af09438f8f497cf4_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
eb882de8948f19a9af09438f8f497cf4_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
eb882de8948f19a9af09438f8f497cf4_JaffaCakes118
-
Size
216KB
-
MD5
eb882de8948f19a9af09438f8f497cf4
-
SHA1
0948e3dc970ce0a3109ade38d42eb2a8f86774ff
-
SHA256
53c60da165c9b8961e8bd05930a2d16f00dcd932f69fd543b899897c8ab9e3c4
-
SHA512
c9f4c6752fb9c488ddd43bc50e9e31af95db6b1a4149ab9db82a15c21de06aa332de2832b45d63c262672c3f7ef15f76e45f2e6d07e26d107602621e2d299d8f
-
SSDEEP
3072:w6oKnFDpRL54xUo/4Wi+YTvQvC/1jNMUbIOPbOOebWoqC0qzLP0gaApWq3vPiPMY:wk9LLZWgvWCtJbFPbOOxocG0zK3iP5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb882de8948f19a9af09438f8f497cf4_JaffaCakes118
Files
-
eb882de8948f19a9af09438f8f497cf4_JaffaCakes118.dll windows:4 windows x86 arch:x86
9261d1cf4b9330a999dc897d0df33b22
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
xpcom_core
?Equals@nsCSubstring@@QBEHABV1@@Z
?StringBeginsWith@@YAHABVnsACString_internal@@0ABVnsCStringComparator@@@Z
??_7nsDefaultCStringComparator@@6B@
PL_DHashClearEntryStub
?Clear@nsCOMArray_base@@IAEXXZ
?CallCreateInstance@@YAIABUnsID@@PAVnsISupports@@0PAPAX@Z
?CallGetService@@YAIABUnsID@@0PAPAX@Z
?AppendUTF8toUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?ToNewCString@@YAPADABVnsACString_internal@@@Z
?NS_NewArrayEnumerator@@YAIPAPAVnsISimpleEnumerator@@ABVnsCOMArray_base@@@Z
?RemoveObjectAt@nsCOMArray_base@@IAEHH@Z
?NS_NewArrayEnumerator@@YAIPAPAVnsISimpleEnumerator@@PAVnsISupportsArray@@@Z
?Assign@nsSubstring@@QAEXPBGI@Z
?AppendASCIItoUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?ToInteger@nsString@@QBEHPAHI@Z
?AppendInt@nsString@@QAEXHH@Z
?Replace@nsSubstring@@QAEXIIPBGI@Z
?sEmptyBuffer@?$nsCharTraits@G@@2PBGB
?Assign@nsSubstring@@QAEXABV1@@Z
?Assign@nsSubstring@@QAEXABVnsAString_internal@@@Z
?Equals@nsSubstring@@QBEHABVnsAString_internal@@@Z
?HashString@@YAIABVnsAString_internal@@@Z
?RemoveElementsAt@nsVoidArray@@QAEHHH@Z
?EqualsASCII@nsSubstring@@QBEHPBDI@Z
?LossyAppendUTF16toASCII@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
?NS_NewAtom@@YAPAVnsIAtom@@ABVnsAString_internal@@@Z
?Trim@nsString@@QAEXPBDHHH@Z
?SizeTo@nsAutoVoidArray@@UAEHH@Z
?Compact@nsAutoVoidArray@@UAEXXZ
?GrowArrayBy@nsVoidArray@@MAEHH@Z
?NS_RegisterStaticAtoms@@YAIPBUnsStaticAtom@@I@Z
?ReplaceASCII@nsCSubstring@@QAEXIIPBDI@Z
??1nsPrintfCString@@QAE@XZ
?assign_from_gs_cid_with_error@nsCOMPtr_base@@QAEXABVnsGetServiceByCIDWithError@@ABUnsID@@@Z
??1nsCOMArray_base@@IAE@XZ
?Assign@nsCSubstring@@QAEXABVnsACString_internal@@@Z
?Length@nsAString_internal@@QBEIXZ
?Assign@nsAString_internal@@QAEXABV1@@Z
?Assign@nsACString_internal@@QAEXABV1@@Z
?Append@nsACString_internal@@QAEXD@Z
?Append@nsACString_internal@@QAEXPBD@Z
?CopyUTF8toUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?StringBeginsWith@@YAHABVnsAString_internal@@0ABVnsStringComparator@@@Z
??_7nsDefaultStringComparator@@6B@
?assign_from_gs_cid@nsCOMPtr_base@@QAEXVnsGetServiceByCID@@ABUnsID@@@Z
?SetLength@nsSubstring@@QAEXI@Z
?Mid@nsString@@QBEIAAV1@II@Z
??0nsQueryReferent@@QAE@PAVnsIWeakReference@@PAI@Z
?strdup@nsCRT@@SAPADPBD@Z
?NS_GetWeakReference@@YAPAVnsIWeakReference@@PAVnsISupports@@PAI@Z
?assign_from_gs_contractid@nsCOMPtr_base@@QAEXVnsGetServiceByContractID@@ABUnsID@@@Z
?ReplaceASCII@nsSubstring@@QAEXIIPBDI@Z
NS_Free_P
?LowerCaseEqualsASCII@nsSubstring@@QBEHPBDI@Z
?EmptyString@@YAABVnsString@@XZ
?RFindChar@nsString@@QBEHGHH@Z
nsEscape
?Find@nsString@@QBEHPBDHHH@Z
?CopyASCIItoUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
??0nsSingletonEnumerator@@QAE@PAVnsISupports@@@Z
?Equals@nsCSubstring@@QBEHPBD@Z
??0nsSupportsWeakReference@@QAE@XZ
?Assign@nsCSubstring@@QAEXPBDI@Z
?GetWeakReference@nsSupportsWeakReference@@UAGIPAPAVnsIWeakReference@@@Z
??_7nsSupportsWeakReference@@6B@
?strdup@nsCRT@@SAPAGPBG@Z
?strcmp@nsCRT@@SAHPBG0@Z
?HashCode@nsCRT@@SAIPBGPAI@Z
?strcmp@nsCRT@@SAHPBD0@Z
?HashCode@nsCRT@@SAIPBDPAI@Z
?Init@nsPromiseFlatCString@@AAEXABVnsACString_internal@@@Z
?Assign@nsCSubstring@@QAEXABVnsCSubstringTuple@@@Z
??0nsGetClassObjectByContractID@@QAE@PBDPAI@Z
??0nsGetClassObjectByCID@@QAE@ABUnsID@@PAI@Z
?GetReadableBuffer@nsACString_internal@@IBEIPAPBD@Z
??0nsArrayEnumerator@@QAE@PAVnsISupportsArray@@@Z
PL_DHashTableRawRemove
?NS_NewISupportsArray@@YAIPAPAVnsISupportsArray@@@Z
PL_DHashTableDestroy
PL_DHashTableEnumerate
??1nsFixedSizeAllocator@@QAE@XZ
?Init@nsFixedSizeAllocator@@QAEIPBDPBIHHH@Z
?Free@nsFixedSizeAllocator@@QAEXPAXI@Z
?Alloc@nsFixedSizeAllocator@@QAEPAXI@Z
?RemoveObject@nsCOMArray_base@@IAEHPAVnsISupports@@@Z
PL_DHashTableOperate
?InsertObjectAt@nsCOMArray_base@@IAEHPAVnsISupports@@H@Z
?assign_with_AddRef@nsCOMPtr_base@@QAEXPAVnsISupports@@@Z
?FindChar@nsCSubstring@@QBEHDI@Z
??0nsVoidArray@@QAE@XZ
NS_NewEmptyEnumerator
?ElementAt@nsVoidArray@@QBEPAXH@Z
PL_DHashGetStubOps
PL_NewDHashTable
NS_NewCStringInputStream
?assign_from_helper@nsCOMPtr_base@@QAEXABVnsCOMPtr_helper@@ABUnsID@@@Z
??0nsCreateInstanceByContractID@@QAE@PBDPAVnsISupports@@PAI@Z
??0nsCreateInstanceByCID@@QAE@ABUnsID@@PAVnsISupports@@PAI@Z
?Length@nsACString_internal@@QBEIXZ
PL_DHashAllocTable
PL_DHashFreeTable
PL_DHashMoveEntryStub
PL_DHashFinalizeStub
PL_DHashTableInit
??0nsAutoVoidArray@@QAE@XZ
?InsertElementAt@nsVoidArray@@QAEHPAXH@Z
?IndexOf@nsVoidArray@@QBEHPAX@Z
??1nsVoidArray@@UAE@XZ
?Clear@nsAutoVoidArray@@UAEXXZ
?RFindChar@nsCString@@QBEHGHH@Z
?CallGetService@@YAIPBDABUnsID@@PAPAX@Z
?assign_from_qi_with_error@nsCOMPtr_base@@QAEXABVnsQueryInterfaceWithError@@ABUnsID@@@Z
?assign_from_qi@nsCOMPtr_base@@QAEXVnsQueryInterface@@ABUnsID@@@Z
?assign_from_gs_contractid_with_error@nsCOMPtr_base@@QAEXABVnsGetServiceByContractIDWithError@@ABUnsID@@@Z
?AppendUTF16toUTF8@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
?AppendUTF16toUTF8@@YAXPBGAAVnsACString_internal@@@Z
?Rebind@nsDependentCSubstring@@QAEXABVnsCSubstring@@II@Z
?NS_NewAtom@@YAPAVnsIAtom@@ABVnsACString_internal@@@Z
?NS_NewAtom@@YAPAVnsIAtom@@PBD@Z
?AssignASCII@nsCSubstring@@QAEXPBDI@Z
?Equals@nsACString_internal@@QBEHABV1@@Z
PL_DHashTableFinish
?SetLength@nsCSubstring@@QAEXI@Z
?Adopt@nsCSubstring@@QAEXPADI@Z
?AppendInt@nsCString@@QAEXHH@Z
?Assign@nsCSubstring@@QAEXABV1@@Z
??1nsACString_internal@@QAE@XZ
??1nsAString_internal@@QAE@XZ
??1nsCOMPtr_base@@QAE@XZ
?sEmptyBuffer@?$nsCharTraits@D@@2PBDB
?Replace@nsCSubstring@@QAEXIIPBDI@Z
?EnsureMutable@nsCSubstring@@IAEXXZ
?sCanonicalVTable@nsObsoleteACString@@2PBXB
?sCanonicalVTable@nsObsoleteAString@@2PBXB
??0nsPrintfCString@@QAA@IPBDZZ
?NS_NewGenericModule2@@YAIPBUnsModuleInfo@@PAPAVnsIModule@@@Z
nspr4
PR_Malloc
PR_Free
PR_AtomicIncrement
PR_AtomicDecrement
PR_Now
PR_Realloc
PR_FormatTimeUSEnglish
PR_ExplodeTime
PR_LocalTimeParameters
PR_smprintf
PR_ParseTimeString
plc4
PL_strncmp
PL_strfree
PL_strdup
plds4
PL_HashTableDestroy
PL_HashTableAdd
PL_HashTableRawLookup
PL_HashTableRawRemove
PL_NewHashTable
PL_HashString
PL_CompareStrings
PL_CompareValues
PL_HashTableLookup
kernel32
LoadLibraryA
GetProcAddress
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
GetDriveTypeA
SetUnhandledExceptionFilter
msvcr80
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
free
_encoded_null
_malloc_crt
_encode_pointer
tolower
sprintf
strncmp
strchr
atoi
_purecall
strlen
??_V@YAXPAX@Z
memcmp
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
?terminate@@YAXXZ
Exports
Exports
Sections
.text Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ