ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
456391fd2a31c70bea3acfb756aeee43_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
456391fd2a31c70bea3acfb756aeee43_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
456391fd2a31c70bea3acfb756aeee43_JaffaCakes118
-
Size
64KB
-
MD5
456391fd2a31c70bea3acfb756aeee43
-
SHA1
3eff527e007c83871c515e41a47e2199373ee804
-
SHA256
766019859e6ec320b14f52fb3f28adcfbd43559fc46b7fdec23ea85ba5b898fc
-
SHA512
28de981d3d54c4138a22d9b2148caf5a9e414fb733d2fb4f4a8b6ec73aa66ee4fed459e117b0e57b634d95b74ffd4f6e3481648ce146109b4d88bea86e581fbe
-
SSDEEP
1536:p8DQFvj/tgWnnqAlJ1W3DuWeyRLyzy0mqtLEBZl:p8DOxZnqAlJ1W3iWVRGzYqtLEBZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 456391fd2a31c70bea3acfb756aeee43_JaffaCakes118
Files
-
456391fd2a31c70bea3acfb756aeee43_JaffaCakes118.dll windows:4 windows x86 arch:x86
d6adac543d8dca95583c8d2c2b312598
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
select
__WSAFDIsSet
socket
connect
ntohs
getsockname
send
closesocket
htons
WSACleanup
WSAStartup
inet_ntoa
inet_addr
recv
gethostbyname
mfc42
ord2648
ord2055
ord4441
ord3749
ord4837
ord6376
ord1727
ord5261
ord5065
ord2124
ord5277
ord4627
ord4425
ord3597
ord324
ord641
ord4234
ord1168
ord2379
ord755
ord470
ord551
ord2764
ord922
ord5280
ord3798
ord4129
ord1176
ord858
ord6663
ord2915
ord860
ord939
ord941
ord2614
ord2818
ord535
ord540
ord800
ord825
ord537
ord826
ord600
ord1578
ord6467
ord1255
ord1253
ord1570
ord1197
ord1243
ord269
ord342
ord1182
ord1577
ord1575
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4710
ord4998
ord4853
ord4376
ord5265
ord2725
ord3953
ord815
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord823
ord924
ord4277
ord2446
ord1116
msvcrt
strcmp
??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
_onexit
__dllonexit
_iob
fprintf
wcslen
putc
getc
time
srand
rand
strstr
fflush
fopen
fclose
_strupr
_mbscmp
atol
strtok
atoi
memcpy
strlen
_EH_prolog
__CxxFrameHandler
memset
strcat
strcpy
free
malloc
strchr
_stricmp
_strlwr
_itoa
kernel32
GetOverlappedResult
GetSystemTime
GetComputerNameA
GetLocaleInfoA
GetVolumeInformationA
GetTickCount
lstrcatA
GetCurrentProcess
lstrcpyA
GetEnvironmentVariableA
CreatePipe
PeekNamedPipe
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
CreateProcessA
GetFileAttributesExA
FileTimeToSystemTime
GetLastError
Sleep
GetFileSize
ReadFile
SetFilePointer
WriteFile
SetEndOfFile
SystemTimeToFileTime
GetTempPathA
GetTempFileNameA
LoadLibraryA
GetProcAddress
SetFileTime
SetFileAttributesA
CreateFileA
CloseHandle
ExitThread
GetVersionExA
TerminateThread
GetSystemDirectoryA
DeleteFileA
lstrlenA
GetModuleFileNameA
FreeLibrary
DeviceIoControl
lstrcmpA
CreateEventA
CreateMutexA
WideCharToMultiByte
MultiByteToWideChar
LocalFree
GetCurrentThreadId
GetModuleHandleA
LocalAlloc
CreateThread
user32
GetClientRect
DrawIcon
GetSystemMetrics
SendMessageA
wsprintfA
ExitWindowsEx
EnableWindow
SetUserObjectSecurity
IsIconic
GetUserObjectSecurity
CloseDesktop
SetThreadDesktop
CloseWindowStation
GetProcessWindowStation
SetProcessWindowStation
GetThreadDesktop
advapi32
OpenServiceA
StartServiceA
RegEnumKeyExA
DuplicateTokenEx
GetTokenInformation
AllocateLocallyUniqueId
SetTokenInformation
GetSecurityDescriptorDacl
BuildExplicitAccessWithNameA
SetEntriesInAclA
MakeAbsoluteSD
DeleteService
LookupPrivilegeValueA
AdjustTokenPrivileges
ImpersonateLoggedOnUser
CloseServiceHandle
RegQueryValueExA
CreateProcessAsUserA
ControlService
SetSecurityDescriptorDacl
IsValidSecurityDescriptor
LookupAccountNameA
RevertToSelf
RegOpenKeyExA
OpenSCManagerA
RegCloseKey
RegSetValueExA
OpenProcessToken
shell32
ShellExecuteA
shlwapi
StrStrA
netapi32
NetUserGetLocalGroups
NetUserEnum
NetApiBufferFree
Exports
Exports
Sections
.text Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ