ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
88c18f859377a90c192515eecc2e35e5_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
88c18f859377a90c192515eecc2e35e5_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
88c18f859377a90c192515eecc2e35e5_JaffaCakes118
-
Size
96KB
-
MD5
88c18f859377a90c192515eecc2e35e5
-
SHA1
d7742aa5a63a7a4dc9ba2519f4b28b0410266450
-
SHA256
bc57f0814c6700f2b7c0a9c1297b790c61e3c155be34400a9220bc585aeb1269
-
SHA512
7ab4c15948a6f9b1794e400a89dab6d193b9bafafcb36677253f2b34ec6221a23d57012e788dba23c037b0536d3807d9ecc89d72d3a4285ff9bb73a31c98bd95
-
SSDEEP
3072:sEYHzWbj5gK9UlWtL6seVJooXHfDK3clI2:yIjuWtLOjHfDKY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 88c18f859377a90c192515eecc2e35e5_JaffaCakes118
Files
-
88c18f859377a90c192515eecc2e35e5_JaffaCakes118.dll windows:4 windows x86 arch:x86
04eab34cc28b293f17d5cc90e70ec5b8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
psapi
EnumProcessModules
GetModuleFileNameExA
kernel32
SetFilePointer
ReadProcessMemory
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualProtectEx
VirtualAllocEx
GetWindowsDirectoryA
FreeLibrary
lstrcpyA
WritePrivateProfileStringA
GetPrivateProfileStringA
SetUnhandledExceptionFilter
CreateThread
WaitForSingleObject
FreeConsole
SetEvent
CreateEventA
ReadFile
GetCurrentThreadId
WriteFile
InitializeCriticalSection
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
LocalFree
FlushFileBuffers
SetStdHandle
GetOEMCP
lstrlenA
DeleteFileA
SetLastError
GetLastError
LoadLibraryA
GetProcAddress
OpenProcess
lstrlenW
WideCharToMultiByte
LeaveCriticalSection
Sleep
GetCurrentProcess
WriteProcessMemory
GetTickCount
GetModuleFileNameA
GetModuleHandleA
VirtualProtect
lstrcatA
HeapAlloc
HeapFree
CreateFileA
DeviceIoControl
CloseHandle
GetSystemDirectoryA
DeleteCriticalSection
EnterCriticalSection
GetACP
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetCPInfo
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsBadCodePtr
IsBadReadPtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
UnhandledExceptionFilter
HeapSize
TerminateProcess
ExitProcess
RtlUnwind
RaiseException
InterlockedDecrement
InterlockedIncrement
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
GetVersion
TlsAlloc
TlsFree
user32
GetProcessWindowStation
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
wsprintfA
FindWindowExA
FindWindowA
PostMessageA
SendMessageA
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
CloseDesktop
advapi32
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenProcessToken
ImpersonateLoggedOnUser
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegEnumValueA
RegOpenKeyExA
RegEnumKeyExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
ole32
CoInitialize
CoCreateInstance
oleaut32
VariantClear
SysFreeString
wininet
InternetOpenA
HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
ws2_32
gethostbyname
WSAStartup
closesocket
recv
send
setsockopt
connect
bind
socket
gethostname
inet_addr
htons
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
Exports
Exports
Sections
.text Size: 60KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ