Static task
static1
Behavioral task
behavioral1
Sample
f7278a3e1b9155fea0d927afb9200f3b_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f7278a3e1b9155fea0d927afb9200f3b_JaffaCakes118.dll
Resource
win10v2004-20240910-en
General
-
Target
f7278a3e1b9155fea0d927afb9200f3b_JaffaCakes118
-
Size
58KB
-
MD5
f7278a3e1b9155fea0d927afb9200f3b
-
SHA1
acefbc77dbb788f072f2676d0f9a2e83dd41ba12
-
SHA256
fff4df2225b9dc84913b2eb8631f6f64264c6fc4b03a49fb48b25d355a6464e6
-
SHA512
fd7939d0ea64cbfeb873df21fb243fc1418b28eb03ecb182fd0bfcb62d2131b0042e1be403ff07981381544e93a4fcca44e4c246c2a91152818ef60c8e84b7dc
-
SSDEEP
1536:8hlSLc8gERudJWysYDVfr2nwf+jiNBthvlBsCJXBvRcASU:8hAc8T0LsYVxhNXBvqASU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f7278a3e1b9155fea0d927afb9200f3b_JaffaCakes118
Files
-
f7278a3e1b9155fea0d927afb9200f3b_JaffaCakes118.dll windows:4 windows x86 arch:x86
202e9d223d522cbd503c8990b7952574
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord1158
ord924
ord858
ord535
ord2846
ord537
ord2915
ord825
ord540
ord860
ord2764
ord1168
ord6648
ord4129
ord800
ord823
msvcrt
_adjust_fdiv
_initterm
free
malloc
printf
strncmp
exit
strncpy
time
srand
strstr
rand
__CxxFrameHandler
strchr
atoi
sprintf
_strcmpi
kernel32
OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
TerminateProcess
GetModuleHandleA
Sleep
ExitThread
CreateThread
lstrlenA
WinExec
GetSystemDirectoryA
CreateProcessA
Process32Next
Process32First
CloseHandle
GetProcAddress
UnmapViewOfFile
CreateMutexA
CreateFileMappingA
GetLastError
MapViewOfFile
WaitForSingleObject
ReleaseMutex
GetVersionExA
GlobalMemoryStatus
CreateToolhelp32Snapshot
user32
wsprintfA
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
urlmon
URLDownloadToFileA
ws2_32
WSAStartup
inet_addr
htons
connect
socket
closesocket
recv
WSAGetLastError
__WSAFDIsSet
select
gethostbyname
send
winmm
timeGetTime
Sections
.text Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ