NSPStartup
Static task
static1
Behavioral task
behavioral1
Sample
156612d2480de8d507d13280a816db6d_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
156612d2480de8d507d13280a816db6d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
156612d2480de8d507d13280a816db6d_JaffaCakes118
-
Size
116KB
-
MD5
156612d2480de8d507d13280a816db6d
-
SHA1
6ae9cf71ac258b5c9b4637d3ea733422cbe7afa4
-
SHA256
1899d327bbe6c5fa9dc146d7d1e25359b8c73b1fb209ffb99e4224806acb2c61
-
SHA512
9880cf6c6538fc1a7c5bcf0b097d7fd6bc7b9c6f11aa2114904686f8aa1b254c6c45f5937742117f230bb6c91fb3395df3e5e7df2a18354b65be1b1f1011e469
-
SSDEEP
3072:eqKiHnqMUQLR8SoTIU/81g3gNn5uEKoLyBTtB:eq3nqJQn7U/8cEKf3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 156612d2480de8d507d13280a816db6d_JaffaCakes118
Files
-
156612d2480de8d507d13280a816db6d_JaffaCakes118.dll windows:4 windows x86 arch:x86
53d68bb241c530425b04a6c49b254386
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
lstrlenA
RtlMoveMemory
GetWindowsDirectoryA
OpenFile
_lclose
_lread
_llseek
lstrcmpiA
lstrcpyA
InterlockedExchange
lstrcpynA
EnterCriticalSection
GetProcAddress
CreateFileA
lstrcatA
CloseHandle
DeviceIoControl
TlsGetValue
LocalFree
LocalAlloc
GetTickCount
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
GetSystemDirectoryA
ExpandEnvironmentStringsA
SetLastError
GlobalAlloc
TlsSetValue
TlsAlloc
TlsFree
GlobalFree
GetLastError
GetComputerNameA
LoadLibraryA
advapi32
RegEnumValueA
RegCreateKeyExA
RegEnumKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegOpenKeyA
user32
CharLowerA
CharUpperA
wsprintfA
ws2_32
socket
closesocket
__WSAFDIsSet
select
sendto
Exports
Exports
Sections
.text Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 183B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 936B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ