ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
e75393dca3c656af0271bcbd17439965_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e75393dca3c656af0271bcbd17439965_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
e75393dca3c656af0271bcbd17439965_JaffaCakes118
-
Size
88KB
-
MD5
e75393dca3c656af0271bcbd17439965
-
SHA1
4fae2993167aeabb1c4480a6bb6a6a03489618ec
-
SHA256
ecb13bc8ede9aa31737880614164aa93438a40f1c81e97edb84c4f88904b496a
-
SHA512
ad12d9faac5178d11d8eddcab90c44e13aaecba44e4acad327862c2c19fa1e3a00bc6b4ac59d1553f0d119363133affc55c6c4a0755ec27382f9741c48217ef5
-
SSDEEP
1536:k92WJ5c2YaIj0KjblJrIWTYd3N9T4iQmepBxZEoUKK15Y:k92WJzY/j3MWgjYxZEoUKKbY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e75393dca3c656af0271bcbd17439965_JaffaCakes118
Files
-
e75393dca3c656af0271bcbd17439965_JaffaCakes118.dll windows:4 windows x86 arch:x86
5f698485c661d316aa8858906cb6b784
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualAllocEx
VirtualProtectEx
lstrcpyA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetPrivateProfileStringA
WritePrivateProfileStringA
CreateThread
SetUnhandledExceptionFilter
SetLocalTime
GetLocalTime
WaitForSingleObject
FreeConsole
SetEvent
CreateEventA
GetCurrentThreadId
GetWindowsDirectoryA
LocalFree
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
FreeLibrary
GetProcAddress
LoadLibraryA
ReadProcessMemory
OpenProcess
CreateFileA
SetFilePointer
ReadFile
CloseHandle
lstrlenA
DeleteFileA
SetLastError
GetLastError
lstrlenW
WideCharToMultiByte
GetCurrentProcess
WriteProcessMemory
GetTickCount
Sleep
GetModuleFileNameA
GetModuleHandleA
VirtualProtect
lstrcatA
HeapFree
HeapAlloc
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
VirtualAlloc
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
RtlUnwind
RaiseException
InterlockedDecrement
InterlockedIncrement
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
HeapReAlloc
HeapSize
TlsAlloc
TlsFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
user32
wsprintfA
FindWindowExA
FindWindowA
OpenInputDesktop
GetThreadDesktop
GetUserObjectInformationA
CloseDesktop
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
OpenDesktopA
SetThreadDesktop
GetWindowThreadProcessId
SendMessageA
PostMessageA
advapi32
OpenProcessToken
RegisterServiceCtrlHandlerA
SetServiceStatus
ImpersonateLoggedOnUser
RevertToSelf
RegCreateKeyA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegEnumValueA
RegEnumKeyExA
RegOpenKeyExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
ole32
CoInitializeEx
CoCreateInstance
oleaut32
SysFreeString
VariantClear
psapi
EnumProcessModules
GetModuleFileNameExA
wininet
HttpSendRequestA
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
Exports
Exports
Sections
.text Size: 52KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ