msgsvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
04ee2b603a5b461320fb2ffd79ea1ad8_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
04ee2b603a5b461320fb2ffd79ea1ad8_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
04ee2b603a5b461320fb2ffd79ea1ad8_JaffaCakes118
-
Size
89KB
-
MD5
04ee2b603a5b461320fb2ffd79ea1ad8
-
SHA1
c17bae77314cb7abb2ef8871c569fc4c6f1f9d3a
-
SHA256
9b4990fdcfd810504ce7463bdba31ae1650caa9d2e9ce49d165c04e5f3cbbf77
-
SHA512
c1a16e1c859e8d77ece526bc3eaed4d5fe3f126c6391568fdd13b3c38fc1d9e068820b788516cc80fdf4e38a8d9c2cccf7c8567fcb977f108de8b5d0740aaa59
-
SSDEEP
1536:YzhR2pgw8xtPAzOXE8iFUvTRWYT5IYnYKoyRZFkV7JtPmjcbo1Tx:Yzv2pgwiPAgwoTxTPRcJJQjb1Tx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04ee2b603a5b461320fb2ffd79ea1ad8_JaffaCakes118
Files
-
04ee2b603a5b461320fb2ffd79ea1ad8_JaffaCakes118.dll windows:5 windows x86 arch:x86
c5bdb7ee6eb35d767050e3308a943a62
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntdll
NtQueryVirtualMemory
RtlUnwind
DbgPrint
wcsncmp
_strnicmp
wcsncpy
RtlReleaseResource
RtlAcquireResourceExclusive
RtlAcquireResourceShared
wcsstr
RtlFreeUnicodeString
NtOpenThreadToken
NtQueryInformationToken
NtClose
RtlRegisterWait
RtlInitializeCriticalSection
RtlNtStatusToDosError
NtAccessCheckAndAuditAlarm
RtlAdjustPrivilege
RtlInitUnicodeString
_itoa
wcscmp
RtlCopySid
RtlLengthSid
RtlSetSaclSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAce
RtlCreateAcl
RtlNewSecurityObject
NtOpenProcessToken
RtlDeregisterWait
strncpy
RtlUnicodeStringToOemString
RtlFreeOemString
RtlInitAnsiString
RtlInitializeResource
RtlOemStringToUnicodeString
wcslen
wcscpy
kernel32
WideCharToMultiByte
MultiByteToWideChar
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
LocalFree
LocalAlloc
GetLastError
LeaveCriticalSection
SetEvent
EnterCriticalSection
DeleteCriticalSection
TerminateThread
CloseHandle
GetTimeFormatW
GetDateFormatW
WaitForSingleObject
CreateThread
CreateEventW
CreateMailslotA
ReadFile
Sleep
WriteFile
InterlockedExchange
CreateFileA
GetOverlappedResult
GetLocalTime
FreeLibrary
FormatMessageA
FormatMessageW
LoadLibraryExW
GetComputerNameW
GetProcAddress
LoadLibraryW
DisableThreadLibraryCalls
advapi32
QueryServiceConfigW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
SetServiceStatus
RegisterServiceCtrlHandlerExW
user32
RegisterDeviceNotificationW
UnregisterDeviceNotification
MessageBeep
MessageBoxW
netapi32
I_NetNameCanonicalize
Netbios
NetApiBufferFree
NetWkstaUserEnum
I_NetNameValidate
ws2_32
WSACleanup
WSAStartup
inet_addr
gethostbyaddr
rpcrt4
NdrServerCall2
RpcImpersonateClient
RpcRevertToSelf
iphlpapi
NotifyAddrChange
Exports
Exports
ServiceMain
SvchostPushServiceGlobals
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ