InitHelperDll
Static task
static1
Behavioral task
behavioral1
Sample
002cf085e3fb9bba6696f62f2a9405e8_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
002cf085e3fb9bba6696f62f2a9405e8_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
002cf085e3fb9bba6696f62f2a9405e8_JaffaCakes118
-
Size
25KB
-
MD5
002cf085e3fb9bba6696f62f2a9405e8
-
SHA1
a5855cd00ab8977546e898a95047fc72fdabcc82
-
SHA256
57de509faa611b5223d4348945cbd75d62379ae2bbc27011c55265e29bcd274c
-
SHA512
3870662b90be9231fb2a86b18b5b3090ac514b9798e9c43f72b93f0db8b983378dea18e983e593436cba11f862203e3b6dc81e45a45c60d77e8cd9eed4577e78
-
SSDEEP
384:VcVEdyPUojgtdn6DrTEn08XqJAqUXYxl4Sl2tcrThyhWl42J3dw:VDy8ojgtIsn0QZlKld2tOThyH2JK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 002cf085e3fb9bba6696f62f2a9405e8_JaffaCakes118
Files
-
002cf085e3fb9bba6696f62f2a9405e8_JaffaCakes118.dll windows:5 windows x86 arch:x86
7ddbb81db3870b95876c4f80e1a97338
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
free
wcscat
wcsncpy
calloc
wcscpy
__CxxFrameHandler
wcsstr
wcstok
_snwprintf
wcslen
_itow
wcsncat
msvcp60
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
ntdll
RtlCompressBuffer
RtlAllocateHeap
RtlGetCompressionWorkSpaceSize
RtlDecompressBuffer
RtlFreeHeap
advapi32
RegCloseKey
RegOpenKeyW
RegDeleteValueW
RegCreateKeyExW
RegCreateKeyW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
ControlService
kernel32
InterlockedIncrement
InterlockedDecrement
CloseHandle
GetCurrentProcess
DeleteFileW
UnmapViewOfFile
HeapFree
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
WriteFile
VirtualFree
DisableThreadLibraryCalls
VirtualAlloc
ReadFile
HeapAlloc
GetProcessHeap
netsh.exe
PrintMessageFromModule
RegisterHelper
PrintMessage
PrintError
MatchToken
MatchEnumTag
RegisterContext
ole32
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree
oleaut32
SysAllocString
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringLen
shlwapi
SHGetValueW
userenv
ExpandEnvironmentStringsForUserW
Exports
Exports
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 934B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ