Static task
static1
Behavioral task
behavioral1
Sample
093daee4c6d5cd18556e43a5b4219541_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
093daee4c6d5cd18556e43a5b4219541_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
093daee4c6d5cd18556e43a5b4219541_JaffaCakes118
-
Size
28KB
-
MD5
093daee4c6d5cd18556e43a5b4219541
-
SHA1
22b927135a7cc77b971b00d9112b712b2578b366
-
SHA256
e2dd525ef712f3f6b585a7b8c217cf3a31dbc1fc8f35652f4219f9eb3bfbdf83
-
SHA512
dee9b594489390a700f320682f62ea8e5d9e8a5a773ecfdc4c060085e40181b55279da6f90ccf6161deda927aa3e26dbf3455c42ad0e1e39a78ecd95f99d0024
-
SSDEEP
384:w0zwg1fl4xG/2sS3IZ0PYP5YHZwPzurie/MvZO:w01NiKhP0PYPiwP6rf/4Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 093daee4c6d5cd18556e43a5b4219541_JaffaCakes118
Files
-
093daee4c6d5cd18556e43a5b4219541_JaffaCakes118.dll windows:4 windows x86 arch:x86
0e4483c5ba4b09836690c9a78ea33e17
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
closesocket
ntohs
msvcrt
free
_initterm
malloc
atoi
_itoa
strcmp
memcpy
strstr
strrchr
fseek
ftell
strchr
strncpy
??2@YAPAXI@Z
sprintf
??3@YAXPAX@Z
fopen
fwrite
fclose
fread
time
memset
_strupr
_strlwr
_adjust_fdiv
kernel32
Sleep
GetModuleHandleA
GlobalAlloc
GlobalLock
CreateThread
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
GetTempPathA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
GetModuleFileNameA
lstrcpyA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ