Scan
Static task
static1
Behavioral task
behavioral1
Sample
3d94fd5a4d9b66e3691b71237d041383_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3d94fd5a4d9b66e3691b71237d041383_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3d94fd5a4d9b66e3691b71237d041383_JaffaCakes118
-
Size
70KB
-
MD5
3d94fd5a4d9b66e3691b71237d041383
-
SHA1
888363c57743433a355c66d29689f6d2d719fc35
-
SHA256
a2c782f72d2955952deda245889fe8e80817a3178e1241ba1453d85d7dd9da97
-
SHA512
bdb53673398dbe2a7be50108c4cc2826b302b9064f5a0ded56a23fd4e91061d0dba43b1e55a5263c748587c1bbf53431fd6a0557d2b9cee9ad590763437966d1
-
SSDEEP
768:N6uvOxXfs9KOVMEIFnLnmZS+wYtXScHN61Dpbqw2f34fevZNq0litzYS7+S1DH:N3Oot2EgnLnmZFwYtXScHN6elf34PH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d94fd5a4d9b66e3691b71237d041383_JaffaCakes118
Files
-
3d94fd5a4d9b66e3691b71237d041383_JaffaCakes118.dll windows:4 windows x86 arch:x86
53ee6d73be37174a6fdb788e89081c95
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetSystemDirectoryA
GetFileAttributesA
OutputDebugStringA
GetTempPathA
DeleteFileA
lstrcatA
WinExec
GetLastError
FreeResource
WriteFile
SizeofResource
LockResource
LoadResource
FindResourceA
CreateFileA
ExpandEnvironmentStringsA
DeviceIoControl
UnmapViewOfFile
TerminateProcess
MapViewOfFile
CreateFileMappingA
GetFileSize
ReadFile
WaitForSingleObject
CreateProcessA
GetStartupInfoA
CreatePipe
SetFileAttributesA
CopyFileA
GetDriveTypeA
GetLogicalDriveStringsA
GetWindowsDirectoryA
GetSystemTime
TerminateThread
FindClose
FindNextFileA
FindFirstFileA
LoadLibraryA
GetProcAddress
OpenProcess
CloseHandle
Sleep
ExitProcess
GetTickCount
CreateThread
user32
FindWindowA
GetWindowLongA
ShowWindow
advapi32
OpenSCManagerA
ControlService
CloseServiceHandle
StartServiceA
CreateServiceA
DeleteService
OpenServiceA
ws2_32
inet_ntoa
inet_addr
htons
connect
send
closesocket
gethostbyname
gethostname
WSAStartup
socket
wininet
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
mpr
WNetAddConnection2A
rpcrt4
NdrPointerUnmarshall
NdrConformantStringUnmarshall
NdrAllocate
NdrConformantArrayBufferSize
I_RpcGetBuffer
NdrConformantArrayMarshall
NdrServerInitializeNew
RpcRaiseException
NdrPointerBufferSize
NdrConformantStringBufferSize
NdrPointerMarshall
NdrConformantStringMarshall
NdrConvert
NdrConformantArrayUnmarshall
NdrClientInitializeNew
NdrNsGetBuffer
NdrNsSendReceive
NdrFreeBuffer
RpcStringBindingComposeA
RpcBindingFromStringBindingA
RpcBindingFree
RpcStringFreeA
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
??2@YAPAXI@Z
??3@YAXPAX@Z
strncpy
fputc
_stricmp
atoi
fwrite
sprintf
_except_handler3
printf
malloc
free
fclose
fopen
strchr
ftell
fseek
fread
msvcp60
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?eof@ios_base@std@@QBE_NXZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDH@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?is_open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
Exports
Exports
Sections
.data Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ