ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
34ab37f3135c88e8f3b8e0e2c850aca6_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
34ab37f3135c88e8f3b8e0e2c850aca6_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
34ab37f3135c88e8f3b8e0e2c850aca6_JaffaCakes118
-
Size
25KB
-
MD5
34ab37f3135c88e8f3b8e0e2c850aca6
-
SHA1
39bc2d50bcca660c046f5923d39fe582959455a7
-
SHA256
0a2ada7bcb4e7499cf82169ca4521ed5d01b9d5b453e496d7f7d958934829b4d
-
SHA512
032345990797b89daad9259edc80ea292a56c5e3e2e8cdf8c71b3d4fdac9416f5a023bae2dfaf8a3c21d7a426a44194ff5923c7cd14f45a5b6dfc43ff603d01b
-
SSDEEP
384:lZpvGJpoXgKym0aFfEHCjE5Bi1j2ySYyznPITycPNU9W7:TNGJ6XEQ2BnzYGgG8NU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 34ab37f3135c88e8f3b8e0e2c850aca6_JaffaCakes118
Files
-
34ab37f3135c88e8f3b8e0e2c850aca6_JaffaCakes118.dll windows:4 windows x86 arch:x86
d0c2d375d496bde552987046a03c3b7f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FreeLibraryAndExitThread
GetLastError
GetCurrentProcessId
MoveFileA
GetModuleFileNameA
FreeLibrary
lstrcpynA
OutputDebugStringA
CopyFileA
WriteFile
LockResource
SizeofResource
LoadResource
ExpandEnvironmentStringsA
GetModuleHandleA
DeviceIoControl
Process32Next
Process32First
CreateToolhelp32Snapshot
GetSystemDirectoryA
CreateEventA
lstrcmpiW
DuplicateHandle
LoadLibraryExA
GlobalMemoryStatusEx
WaitForSingleObject
GetVersionExA
GetFileSize
ReadFile
CreateFileA
OpenProcess
DeleteFileA
lstrcmpiA
Sleep
GlobalAlloc
CreateThread
CloseHandle
InterlockedExchangeAdd
GlobalFree
GetTempPathA
GetTickCount
MoveFileExA
LoadLibraryA
FindResourceA
GetProcAddress
user32
wsprintfA
wsprintfW
advapi32
CreateServiceA
RegCreateKeyExA
RegSetValueExA
StartServiceA
QueryServiceStatus
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
OpenSCManagerA
OpenServiceA
ControlService
DeleteService
CloseServiceHandle
RegDeleteValueA
SetServiceStatus
RegisterServiceCtrlHandlerW
ChangeServiceConfigA
ws2_32
getsockopt
sendto
WSAStartup
WSASocketA
gethostname
socket
setsockopt
connect
send
recv
closesocket
htons
inet_addr
htonl
gethostbyname
wininet
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
HttpEndRequestA
InternetReadFile
HttpQueryInfoA
Exports
Exports
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
... Size: 512B - Virtual size: 462B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ