Static task
static1
Behavioral task
behavioral1
Sample
fdcede8c088f1621db6f5aa8d895f0bf_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fdcede8c088f1621db6f5aa8d895f0bf_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fdcede8c088f1621db6f5aa8d895f0bf_JaffaCakes118
-
Size
32KB
-
MD5
fdcede8c088f1621db6f5aa8d895f0bf
-
SHA1
64c90d68beac5aa9f98348eb564fb29f3ab55e96
-
SHA256
403a88c03a9657603d5e199af3e8d362a2c25f27a34a00090422b0c04cd59633
-
SHA512
701a709f22703a4230067136d94b8fb62633669f0c8db6e7087458a5a4c7ee1917326c1c48c7060ccec16034956a8c13616b44ed91cc695b69a8c7ce51ee6330
-
SSDEEP
768:qIbPvVf21jg9Du4ILXELDJjGRECaUBgfmauBa:qIbPvVeiMULDVGRx+u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fdcede8c088f1621db6f5aa8d895f0bf_JaffaCakes118
Files
-
fdcede8c088f1621db6f5aa8d895f0bf_JaffaCakes118.dll windows:4 windows x86 arch:x86
319163952cf2b64c9219b64196d271fc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord1158
ord924
ord858
ord535
ord2846
ord537
ord2915
ord825
ord540
ord860
ord2764
ord1168
ord6648
ord4129
ord800
ord823
msvcrt
_adjust_fdiv
_initterm
free
malloc
printf
strncmp
exit
strncpy
strstr
strchr
atoi
rand
srand
sprintf
__CxxFrameHandler
time
_strcmpi
kernel32
GetModuleHandleA
GetProcAddress
OpenProcess
VirtualAllocEx
WriteProcessMemory
Process32Next
TerminateProcess
CloseHandle
Sleep
lstrlenA
ExitThread
WinExec
Process32First
CreateToolhelp32Snapshot
TerminateThread
CreateRemoteThread
CreateProcessA
UnmapViewOfFile
CreateMutexA
CreateFileMappingA
GetLastError
MapViewOfFile
WaitForSingleObject
ReleaseMutex
GetVersionExA
GlobalMemoryStatus
GetSystemDirectoryA
CreateThread
user32
wsprintfA
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
urlmon
URLDownloadToFileA
ws2_32
WSAStartup
inet_addr
htons
connect
socket
closesocket
recv
WSAGetLastError
__WSAFDIsSet
select
gethostbyname
send
winmm
timeGetTime
Sections
.text Size: - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.delete Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.pklstb Size: 26KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.relo2 Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ