sstpsvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
60f21b841226bf06ea420a5322a4279e_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
60f21b841226bf06ea420a5322a4279e_JaffaCakes118.dll
Resource
win10v2004-20240426-en
General
-
Target
60f21b841226bf06ea420a5322a4279e_JaffaCakes118
-
Size
125KB
-
MD5
60f21b841226bf06ea420a5322a4279e
-
SHA1
fac151ab316231eaf739a4d946567a40c5a5dadb
-
SHA256
fdc563b5afccfb1ddc5fb39187bcaacb2b91528426e8a198a527379cc3eb5c89
-
SHA512
75e52c7769a8cc66015a77ff3a6a97404de909fb352fc41c28407fedeff16ba92a0ed9b783fd6d3eb584b81fdf15355e6d5e1a2c2f4a35dca10d0471fe7a697a
-
SSDEEP
3072:WUTSovoofmxEAPWBCanwzLMeWazN5dT6fuTm3:jSovoofPBCOwzABazHKi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 60f21b841226bf06ea420a5322a4279e_JaffaCakes118
Files
-
60f21b841226bf06ea420a5322a4279e_JaffaCakes118.dll windows:6 windows x86 arch:x86
c6f50aa7601a8ee83c368f6e43aad7d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
_vsnprintf
memset
strchr
memcmp
memcpy
_vsnwprintf
_stricmp
_strcmpi
kernel32
TerminateProcess
GetModuleHandleW
LocalFree
WaitForThreadpoolIoCallbacks
CloseThreadpool
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolIo
CreateThreadpoolIo
CreateThreadpoolCleanupGroup
CreateThreadpool
CreateFileW
SubmitThreadpoolWork
CloseThreadpoolTimer
CreateThreadpoolWork
CreateThreadpoolTimer
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
SetLastError
GetModuleFileNameW
CancelThreadpoolIo
StartThreadpoolIo
DeviceIoControl
CloseThreadpoolWork
CancelIoEx
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
GetProcessHeap
HeapFree
LocalAlloc
UnregisterWaitEx
SetEvent
CloseHandle
GetLastError
CreateEventW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
MultiByteToWideChar
GetModuleHandleExW
WaitForSingleObject
SetThreadpoolTimer
GetTickCount
advapi32
EventWrite
CryptReleaseContext
CryptAcquireContextW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
SetServiceStatus
RegisterServiceCtrlHandlerExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
TraceMessage
user32
LoadStringW
ntdll
RtlCompareMemory
EtwTraceMessage
WinSqmSetDWORD
rtutils
RouterLogEventW
RouterLogDeregisterW
RouterGetErrorStringW
RouterLogEventStringW
RouterLogEventDataW
RouterLogRegisterW
httpapi
HttpSendResponseEntityBody
HttpReceiveHttpRequest
HttpCloseUrlGroup
HttpSendHttpResponse
HttpReceiveRequestEntityBody
HttpInitialize
HttpCreateServerSession
HttpCloseServerSession
HttpTerminate
HttpAddUrlToUrlGroup
HttpCreateRequestQueue
HttpSetUrlGroupProperty
HttpCloseRequestQueue
HttpWaitForDisconnect
HttpCreateUrlGroup
crypt32
CryptUnprotectMemory
CertFreeCertificateContext
CryptHashCertificate
CertGetEnhancedKeyUsage
ws2_32
WSACleanup
WSAStartup
WSAStringToAddressW
rpcrt4
UuidFromStringA
UuidCreate
webio
ord1
ord14
ord18
ord21
ord9
ord24
ord26
ord31
ord17
ord5
ord10
ord27
ord8
ord29
ord25
ord22
ord11
ord23
ord4
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCreateKeyExW
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetProcAddress
LoadLibraryExW
iphlpapi
ConvertInterfaceLuidToIndex
GetAdaptersAddresses
GetIfEntry2
nsi
NsiEnumerateObjectsAllParametersEx
NsiGetAllParametersEx
NsiSetAllParametersEx
api-ms-win-devices-config-l1-1-1
CM_Locate_DevNodeW
CM_Get_Device_IDW
api-ms-win-devices-swdevice-l1-1-1
SwDeviceClose
SwDeviceCreate
api-ms-win-devices-query-l1-1-1
DevCreateObjectQuery
DevCloseObjectQuery
Exports
Exports
ServiceMain
SvchostPushServiceGlobals
Sections
.text Size: 102KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ