?Dll2Main@@YGHPAUHINSTANCE__@@KPAX@Z
Static task
static1
Behavioral task
behavioral1
Sample
2944cfef0680c4a495fea07551c9ac54_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2944cfef0680c4a495fea07551c9ac54_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
2944cfef0680c4a495fea07551c9ac54_JaffaCakes118
-
Size
44KB
-
MD5
2944cfef0680c4a495fea07551c9ac54
-
SHA1
c50ae4ecd2874f15aa551399491c3df0a42d7217
-
SHA256
09b385c3b40109290fcdd47eca0c10f9013904276a17511b1564bede1d998ddd
-
SHA512
800ab696fd0ea66d7bc229e0ccac03e84db41137a442e07d8f31fbdd110577c61eb8d45022bfeaa104353672cbde1d83f2ac75511ff13741ff63a611faed66de
-
SSDEEP
384:EB4FSxR37UF8GlrharX7tWkXwfz0Pba50qYrdexh3jtQOQZW56C:EOkLUF8QMX78Yargrdkhzyi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2944cfef0680c4a495fea07551c9ac54_JaffaCakes118
Files
-
2944cfef0680c4a495fea07551c9ac54_JaffaCakes118.dll windows:4 windows x86 arch:x86
b272c3625fd2844e383a4259fd4d3551
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
urlmon
URLDownloadToFileA
wininet
DeleteUrlCacheEntry
ws2_32
send
WSACleanup
connect
gethostbyname
socket
closesocket
recv
WSAStartup
htons
msvcrt
memcpy
atoi
rand
strncpy
strlen
fopen
printf
fseek
ftell
fgetc
fread
fclose
time
sprintf
strcpy
strcat
strstr
memset
kernel32
GetProcAddress
GetLastError
LocalAlloc
lstrcmpiA
GetCurrentProcess
OpenProcess
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
CreateRemoteThread
Sleep
CloseHandle
GetFileSize
CreateFileA
DeleteFileA
CreateThread
WinExec
lstrcatA
GetSystemDirectoryA
lstrcpyA
lstrlenA
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
FreeLibrary
GetVolumeInformationA
LoadLibraryA
GetComputerNameA
GetModuleFileNameA
GetVersionExA
user32
CharUpperA
EnumWindows
wsprintfA
advapi32
RegQueryValueExA
QueryServiceConfigA
ChangeServiceConfigA
OpenServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
AdjustTokenPrivileges
RegEnumKeyA
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
ole32
CoCreateGuid
Exports
Exports
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 392B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ