Scan
Static task
static1
Behavioral task
behavioral1
Sample
45acf9e837c6233546058d67cc08b2b8_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
45acf9e837c6233546058d67cc08b2b8_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
45acf9e837c6233546058d67cc08b2b8_JaffaCakes118
-
Size
70KB
-
MD5
45acf9e837c6233546058d67cc08b2b8
-
SHA1
363927d2cc1cf6fa3cd9cb4bd49d01af422104e1
-
SHA256
b55005d58343439c302f12e24a3fcef359cccc0632ca3bf7973be1050818d53f
-
SHA512
b1df2855f1b6d9da6944fa0df9deb50d5213f301cd31d996a138da95685c7e85c47ed1912ba9e7c99fc548b1cdf222fe3bd7ab1ec1ad63a3c21109e3ecf03e8b
-
SSDEEP
768:N6MvOxXfs9KOVMEIFnLnmZS+wYtXScHN61Dpbqw2f34fevZNq0litzYS7+S1DH:NZOot2EgnLnmZFwYtXScHN6elf34PH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 45acf9e837c6233546058d67cc08b2b8_JaffaCakes118
Files
-
45acf9e837c6233546058d67cc08b2b8_JaffaCakes118.dll windows:4 windows x86 arch:x86
53ee6d73be37174a6fdb788e89081c95
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetSystemDirectoryA
GetFileAttributesA
OutputDebugStringA
GetTempPathA
DeleteFileA
lstrcatA
WinExec
GetLastError
FreeResource
WriteFile
SizeofResource
LockResource
LoadResource
FindResourceA
CreateFileA
ExpandEnvironmentStringsA
DeviceIoControl
UnmapViewOfFile
TerminateProcess
MapViewOfFile
CreateFileMappingA
GetFileSize
ReadFile
WaitForSingleObject
CreateProcessA
GetStartupInfoA
CreatePipe
SetFileAttributesA
CopyFileA
GetDriveTypeA
GetLogicalDriveStringsA
GetWindowsDirectoryA
GetSystemTime
TerminateThread
FindClose
FindNextFileA
FindFirstFileA
LoadLibraryA
GetProcAddress
OpenProcess
CloseHandle
Sleep
ExitProcess
GetTickCount
CreateThread
user32
FindWindowA
GetWindowLongA
ShowWindow
advapi32
OpenSCManagerA
ControlService
CloseServiceHandle
StartServiceA
CreateServiceA
DeleteService
OpenServiceA
ws2_32
inet_ntoa
inet_addr
htons
connect
send
closesocket
gethostbyname
gethostname
WSAStartup
socket
wininet
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
mpr
WNetAddConnection2A
rpcrt4
NdrPointerUnmarshall
NdrConformantStringUnmarshall
NdrAllocate
NdrConformantArrayBufferSize
I_RpcGetBuffer
NdrConformantArrayMarshall
NdrServerInitializeNew
RpcRaiseException
NdrPointerBufferSize
NdrConformantStringBufferSize
NdrPointerMarshall
NdrConformantStringMarshall
NdrConvert
NdrConformantArrayUnmarshall
NdrClientInitializeNew
NdrNsGetBuffer
NdrNsSendReceive
NdrFreeBuffer
RpcStringBindingComposeA
RpcBindingFromStringBindingA
RpcBindingFree
RpcStringFreeA
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
??2@YAPAXI@Z
??3@YAXPAX@Z
strncpy
fputc
_stricmp
atoi
fwrite
sprintf
_except_handler3
printf
malloc
free
fclose
fopen
strchr
ftell
fseek
fread
msvcp60
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?eof@ios_base@std@@QBE_NXZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDH@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?is_open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
Exports
Exports
Sections
.data Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ