NSGetModule
Static task
static1
Behavioral task
behavioral1
Sample
0590dd668ff83ee68be4e9d74dcf3ee1_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0590dd668ff83ee68be4e9d74dcf3ee1_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0590dd668ff83ee68be4e9d74dcf3ee1_JaffaCakes118
-
Size
281KB
-
MD5
0590dd668ff83ee68be4e9d74dcf3ee1
-
SHA1
12c2a36b0efa07aeb9f00c733ca7a68489c816a3
-
SHA256
67178e9af160977a8818af0dccf6dd3770254721d50f73269c76926835bef8f4
-
SHA512
7901ccff1965736bbdb9265e859a5126c713e67d8c1da8780354781f220121561d39d6f93f60c531395244f7d957897a28dd59f34bacdd8407eae7ebf7ef8e98
-
SSDEEP
3072:klh5hmkwvhhyKfcjqAxUhLlXrIaXAJor416/UL8XpGdmDeYZGmPA:IhWvhjcoJ9ydyZU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0590dd668ff83ee68be4e9d74dcf3ee1_JaffaCakes118
Files
-
0590dd668ff83ee68be4e9d74dcf3ee1_JaffaCakes118.dll windows:5 windows x86 arch:x86
e40a42092bdb25d0fb86ff564442cde0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
xpcom
NS_Alloc
NS_StringContainerInit2
NS_StringContainerFinish
NS_StringContainerInit
NS_StringGetData
NS_StringCopy
NS_StringSetData
nspr4
PR_AtomicDecrement
PR_AtomicIncrement
kernel32
GetConsoleCP
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
GetLastError
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetConsoleMode
lstrlenA
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleFileNameA
MulDiv
SetFilePointer
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
CreateFileA
CloseHandle
GetModuleHandleA
HeapFree
LoadLibraryA
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetStdHandle
WriteFile
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
InterlockedCompareExchange
InterlockedExchange
Sleep
GetLocaleInfoA
FlushFileBuffers
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
HeapAlloc
VirtualProtect
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
GetTimeFormatA
GetDateFormatA
CompareStringA
CompareStringW
GetTimeZoneInformation
HeapCreate
HeapDestroy
VirtualFree
HeapReAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
user32
CharNextA
advapi32
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
ole32
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeEx
CoUninitialize
CoTaskMemFree
oleaut32
SysFreeString
SysStringLen
SysAllocString
SafeArrayDestroy
VarUI4FromStr
DispCallFunc
VariantClear
VariantInit
SafeArrayCopy
SysStringByteLen
SysAllocStringByteLen
Exports
Exports
Sections
.text Size: 216KB - Virtual size: 216KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ