C:\DLL.pdb
Static task
static1
Behavioral task
behavioral1
Sample
537f1329c24230b068f951ae40797d0e_JaffaCakes118.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
537f1329c24230b068f951ae40797d0e_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
537f1329c24230b068f951ae40797d0e_JaffaCakes118
-
Size
18KB
-
MD5
537f1329c24230b068f951ae40797d0e
-
SHA1
2a705c1c8b7874eb4a98de85a503c3ce0e934582
-
SHA256
f9ba34bbe1e6e052927fda983d09ad8b8f4772d0a31f21f82907b93efe164359
-
SHA512
b69140e2d08897dc284b959e4e6bc6d12062669396e6dfcc01ea2ebbdf13529e508c11767fdf7c8924d0f2dff899e3d14ddb10fe8ade44c4fabe700d10ed5186
-
SSDEEP
192:YoDKMeu6h7P+xE30vanMhP51PykQhaCIr:X56h7Ph30CnMhxFXAaCI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 537f1329c24230b068f951ae40797d0e_JaffaCakes118
Files
-
537f1329c24230b068f951ae40797d0e_JaffaCakes118.dll windows:5 windows x86 arch:x86
e6771ad0d0684a95e38dd752e2bb979f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
??3@YAXPAX@Z
strrchr
??2@YAPAXI@Z
rand
srand
memset
shlwapi
SHDeleteKeyA
wininet
GetUrlCacheEntryInfoA
ws2_32
freeaddrinfo
WSACleanup
getaddrinfo
WSAStartup
WSAAddressToStringA
kernel32
CreateToolhelp32Snapshot
Process32Next
MultiByteToWideChar
WriteFile
Process32First
FreeLibrary
ExitProcess
CreateFileA
WaitForSingleObject
OpenProcess
Sleep
CreateProcessA
lstrcmpiA
GetProcAddress
CopyFileA
DeviceIoControl
GetModuleFileNameA
GetModuleHandleA
CloseHandle
ResumeThread
DeleteFileA
CreateThread
lstrcpyA
lstrlenA
ReadFile
WinExec
GetTempPathA
GetSystemTime
LoadLibraryA
LoadLibraryExA
user32
OpenDesktopA
SetProcessWindowStation
SetThreadDesktop
wsprintfA
OpenWindowStationA
advapi32
RegCloseKey
OpenSCManagerA
RegOpenKeyExA
StartServiceA
CreateServiceA
RegSetValueExA
CloseServiceHandle
OpenProcessToken
CreateProcessAsUserA
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 700B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ