ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
75a7234bb066fc8f322fc7872344d114_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
75a7234bb066fc8f322fc7872344d114_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
75a7234bb066fc8f322fc7872344d114_JaffaCakes118
-
Size
72KB
-
MD5
75a7234bb066fc8f322fc7872344d114
-
SHA1
6ebf890a101d849c24e8f750d50d16a74bf90a18
-
SHA256
7c768916303adff764b45b1dfb87ac8b31258fea8ad75c7cb5609cef0c20d657
-
SHA512
070c62501ddde5f2a4e207732d22a0b0a1481f748f9363571bcb11fdbb5e39348a4cc336350c0219d6a15f8da72b8a6d4d2dd9bae912852a9de242d11fa362e0
-
SSDEEP
1536:JKImrGp0oLv01TzR1/EtXKu3qek/oR/9f:UIm6GWvW1Mtzbk/oR/9f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 75a7234bb066fc8f322fc7872344d114_JaffaCakes118
Files
-
75a7234bb066fc8f322fc7872344d114_JaffaCakes118.dll windows:4 windows x86 arch:x86
4b57850dc1c64b179e806fc916c59af1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WinExec
CreateDirectoryA
GetPrivateProfileStringA
GetLocalTime
FindClose
FindNextFileA
DeleteFileA
WritePrivateProfileStringA
GetProcAddress
LoadLibraryA
GetTickCount
CreateThread
FreeConsole
Sleep
CreateFileA
GetFileSize
SetFilePointer
WriteFile
CloseHandle
FindFirstFileA
GetSystemDirectoryA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
RtlUnwind
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
ExitProcess
TerminateProcess
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
GetLastError
WideCharToMultiByte
GetTimeZoneInformation
GetSystemTime
GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
HeapFree
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetModuleHandleA
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
GetCPInfo
SetEnvironmentVariableA
advapi32
SetServiceStatus
RegisterServiceCtrlHandlerA
shell32
ShellExecuteA
shlwapi
PathIsDirectoryA
ws2_32
connect
htons
recv
closesocket
WSACleanup
socket
gethostbyname
inet_addr
inet_ntoa
WSAStartup
send
Exports
Exports
Sections
.text Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ