ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
a7f96ae7f8d95c3837831629c938b07a_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a7f96ae7f8d95c3837831629c938b07a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a7f96ae7f8d95c3837831629c938b07a_JaffaCakes118
-
Size
44KB
-
MD5
a7f96ae7f8d95c3837831629c938b07a
-
SHA1
e90f7df955fd8b0930998e96d490a9304119883e
-
SHA256
f47c845c7f821c392b92d42835e038803ca7c2039816c080190a15a0680062f8
-
SHA512
7e8c97a639644d4bf0035a5626404c405c69895ff322ed282924a19df7e05acb4f84e17acf074a525d122f47eee110f4533b83c60550c2454cce6da811693501
-
SSDEEP
768:zo6L/vWJZpUItxwJIXzeZFnGoIf1peu1AFQeL:zo6LGnprtxwQ4FnGoIf9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a7f96ae7f8d95c3837831629c938b07a_JaffaCakes118
Files
-
a7f96ae7f8d95c3837831629c938b07a_JaffaCakes118.dll windows:4 windows x86 arch:x86
eefe16d6dcaf1a628f0bbf8d2b7da1b3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcess
GetTickCount
SetFileAttributesA
GetModuleFileNameA
lstrcpyA
WaitForSingleObject
CreateThread
GlobalMemoryStatus
GetComputerNameA
GetFileSize
CreateFileA
WriteFile
lstrcpynA
SetThreadPriority
GetCurrentThread
ExitProcess
CreateMutexA
InterlockedExchange
GetCurrentThreadId
MoveFileA
CopyFileA
DeleteFileA
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLastError
FindNextFileA
FindClose
LoadLibraryA
GetProcAddress
FreeLibrary
CreatePipe
CloseHandle
GetStartupInfoA
GetSystemDirectoryA
CreateProcessA
ReadFile
GetVersionExA
Sleep
user32
CloseDesktop
GetProcessWindowStation
GetThreadDesktop
OpenWindowStationA
SetProcessWindowStation
OpenDesktopA
SetThreadDesktop
GetSystemMetrics
IsWindow
SendMessageA
CloseWindow
wsprintfA
CloseWindowStation
ExitWindowsEx
CreateWindowExA
gdi32
CreateCompatibleBitmap
CreateDCA
DeleteDC
GetDIBits
BitBlt
DeleteObject
CreateCompatibleDC
SelectObject
advapi32
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenSCManagerA
OpenServiceA
DeleteService
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
shell32
ShellExecuteA
SHGetFileInfoA
msvcrt
_strlwr
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_ftol
free
_initterm
malloc
_adjust_fdiv
strstr
strcspn
atoi
exit
strncat
sprintf
strncpy
ws2_32
WSAStartup
gethostbyname
inet_addr
closesocket
connect
socket
htons
shutdown
recv
send
WSAIoctl
setsockopt
avicap32
capCreateCaptureWindowA
capGetDriverDescriptionA
Exports
Exports
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ