ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
745935f28b84f0e4afd5fb121285f60d_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
745935f28b84f0e4afd5fb121285f60d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
745935f28b84f0e4afd5fb121285f60d_JaffaCakes118
-
Size
17KB
-
MD5
745935f28b84f0e4afd5fb121285f60d
-
SHA1
6d209d0811443800a275c7f90a5f82f78843ca08
-
SHA256
dab63b56f22aba91c90965a26a878ad5dfb4fb2177788e4c81c20bc998080b20
-
SHA512
2da7b8f6063cd484673be5ced3e4586f395eeef29a401fb25ba081b6862bbfadeef3901bd12ea3a72d20452a733f00625d55a5ab3c90d7e712e8a5fcf9650c45
-
SSDEEP
192:nbfitwlPq9onZjGLx7FKngE1KTXGdvHG5qY568DYEJhaPY+VoSAotLlKJ+0WjOaI:bllLRGtIngE1k2dPN795kJ+HnNko8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 745935f28b84f0e4afd5fb121285f60d_JaffaCakes118
Files
-
745935f28b84f0e4afd5fb121285f60d_JaffaCakes118.dll windows:4 windows x86 arch:x86
ff17a8531c38f11662dbd53833ca4987
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
gdi32
GetDIBits
wsock32
recv
urlmon
URLDownloadToFileA
shell32
ShellExecuteA
advapi32
QueryServiceConfig2A
user32
WindowFromPoint
Exports
Exports
Sections
CODE Size: 13KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE