ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
0d97e3651b85adcd22acc43d095e8ad5_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0d97e3651b85adcd22acc43d095e8ad5_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0d97e3651b85adcd22acc43d095e8ad5_JaffaCakes118
-
Size
34KB
-
MD5
0d97e3651b85adcd22acc43d095e8ad5
-
SHA1
1e38b09b46e450a902b15b72befac0b5ef6c65e1
-
SHA256
bef147183ddfe1bb7e8f7e1532c8e1a94b30694046a9b0dcc19c0c64de5ba343
-
SHA512
e571d3659afa78550269e6f498b7fb3d6bf7bba63f7ea5ad202c095499e2e7a86382d4b119b5228e1f0052fde28ac6b7353da8aa25c907bb5eb3e48614ab557d
-
SSDEEP
192:dfmawq0fyFXEemBZw1ttYugYFpmpb/NCLbFGAOX+SyU5ZB2RYBo9zHJeVurh1hKb:GhfY1tKugGwc3OOS5BvoKgrhPFq1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d97e3651b85adcd22acc43d095e8ad5_JaffaCakes118
Files
-
0d97e3651b85adcd22acc43d095e8ad5_JaffaCakes118.dll windows:4 windows x86 arch:x86
93b8cc6d65229a87ee887c1d46c9c263
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WriteFile
CreateFileA
GetModuleFileNameA
DisableThreadLibraryCalls
CreateThread
ExitProcess
FreeLibrary
WaitForSingleObject
Sleep
DeleteFileA
CreateEventA
ReadFile
CloseHandle
CreateProcessA
GetSystemDirectoryA
GetStartupInfoA
VirtualFreeEx
CreateRemoteThread
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
lstrlenW
OpenProcess
MultiByteToWideChar
lstrcmpA
GetVersion
DeviceIoControl
GetProcAddress
GetCurrentProcessId
lstrcpyA
lstrcatA
lstrlenA
LoadLibraryA
SetFilePointer
user32
wsprintfA
CharUpperA
advapi32
RegCloseKey
OpenServiceA
StartServiceA
CreateServiceA
CloseServiceHandle
RegOpenKeyExA
DeleteService
OpenSCManagerA
ControlService
wininet
InternetCloseHandle
InternetSetOptionA
InternetReadFile
InternetOpenUrlA
InternetOpenA
HttpQueryInfoA
ws2_32
gethostbyname
inet_addr
inet_ntoa
shlwapi
SHDeleteKeyA
msvcrt
??3@YAXPAX@Z
_adjust_fdiv
malloc
_initterm
free
_except_handler3
strstr
strchr
atoi
__CxxFrameHandler
??2@YAPAXI@Z
strrchr
sprintf
Exports
Exports
Sections
.text Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ