ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
5ee68d8ceaea37c51dd50ab8c88b7dbb_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5ee68d8ceaea37c51dd50ab8c88b7dbb_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5ee68d8ceaea37c51dd50ab8c88b7dbb_JaffaCakes118
-
Size
40KB
-
MD5
5ee68d8ceaea37c51dd50ab8c88b7dbb
-
SHA1
d12d27015953ed81e64f84fbb11df3095e835827
-
SHA256
f613afba8108d968fd1e641b6de6b9bbf35c444ca8aa33b5fa0f68edc2f1d205
-
SHA512
0c1b1e0c39ae6eae1c69929e51f040e508bfe5878a5feda73871264afca57250ea8b846d2e2d2abded288b9f7a1182213512089d5485567105079367785145b2
-
SSDEEP
768:nfd/Hb5oK4OQMU1z/X2XhYriXffF3oxoeU268:nf1NIOQ1Rm+iP935eU26
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ee68d8ceaea37c51dd50ab8c88b7dbb_JaffaCakes118
Files
-
5ee68d8ceaea37c51dd50ab8c88b7dbb_JaffaCakes118.dll windows:4 windows x86 arch:x86
c8ee73eade56c63b9f67330cec1d18d5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcessHeap
HeapFree
HeapAlloc
DisconnectNamedPipe
TerminateProcess
TerminateThread
CreateThread
ReadFile
PeekNamedPipe
ExitThread
WriteFile
CreatePipe
DeleteCriticalSection
GetEnvironmentVariableA
CloseHandle
GetCurrentProcess
GetStartupInfoA
FreeLibrary
GetLastError
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
OutputDebugStringA
MultiByteToWideChar
GetVersionExA
LoadLibraryA
GetProcAddress
WaitForMultipleObjects
GetTickCount
Sleep
CreateEventA
SetEvent
WaitForSingleObject
ResetEvent
GetModuleFileNameA
DuplicateHandle
InitializeCriticalSection
OpenProcess
lstrlenA
CreateProcessA
lstrcpynA
GetModuleHandleA
advapi32
GetTokenInformation
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
LogonUserA
CreateProcessAsUserA
SetServiceStatus
RegisterServiceCtrlHandlerA
LookupAccountSidA
msvcrt
srand
time
_wcsnicmp
_ftol
sprintf
strncmp
??1type_info@@UAE@XZ
strcpy
memcpy
memset
_EH_prolog
strlen
__dllonexit
fseek
fopen
fread
realloc
strcat
_except_handler3
_strnicmp
_adjust_fdiv
_initterm
_onexit
rand
fclose
atof
sscanf
_endthreadex
atoi
strncpy
wcstombs
_beginthreadex
free
_CxxThrowException
memmove
malloc
??3@YAXPAX@Z
__CxxFrameHandler
??2@YAPAXI@Z
ws2_32
WSACloseEvent
send
WSAGetLastError
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAResetEvent
ioctlsocket
recv
WSAStartup
WSASocketA
inet_addr
gethostbyname
inet_ntoa
htons
connect
WSAEventSelect
WSACreateEvent
shutdown
closesocket
WSACleanup
gethostname
msvcp60
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??1?$basic_fstream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?clear@ios_base@std@@QAEXH_N@Z
?__Fiopen@std@@YAPAU_iobuf@@PBDH@Z
?_Initcvt@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
??_8?$basic_fstream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@
??_8?$basic_fstream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@
??0ios_base@std@@IAE@XZ
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0locale@std@@QAE@XZ
??_7?$basic_filebuf@DU?$char_traits@D@std@@@std@@6B@
?_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@12@@Z
??_7?$basic_fstream@DU?$char_traits@D@std@@@std@@6B@
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Fpz@std@@3_JB
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?close@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@XZ
??1locale@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1ios_base@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
crypt32
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
Exports
Exports
Sections
.text Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ