ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
ad4db50164490011b74f35c64f865908_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ad4db50164490011b74f35c64f865908_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ad4db50164490011b74f35c64f865908_JaffaCakes118
-
Size
21KB
-
MD5
ad4db50164490011b74f35c64f865908
-
SHA1
65305378b4fcc1289945e44dc7d9b40fa1a19ddb
-
SHA256
560e6f7a2377cb458506e15836ea36c411602d10028ab45949c6e0a30d5eae83
-
SHA512
5e9b418f30f606579f6c1fb30c190c24add26ff892c14e0bf419302488c49f23fdb185b9b50cd28288525ba7089c2e01094a03542ef530c61119c360784ad280
-
SSDEEP
384:Gf94cUzlAtQEap4YLjKEEi3VPIn7/wvt48Or9RfdSGgI2Hwtai46vGuPuLtZjWv6:GV4lhAQTNLSiFQDwvtKdZgI2Q14XuPud
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad4db50164490011b74f35c64f865908_JaffaCakes118
Files
-
ad4db50164490011b74f35c64f865908_JaffaCakes118.dll windows:4 windows x86 arch:x86
4b4c55ed94db1def5e7c09e6017e1985
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CopyFileA
LockResource
SizeofResource
LoadResource
FindResourceA
DeviceIoControl
Process32Next
Process32First
CreateToolhelp32Snapshot
GetSystemDirectoryA
GetCurrentProcessId
CreateDirectoryA
DuplicateHandle
OpenProcess
LoadLibraryExA
GetModuleHandleA
GlobalMemoryStatusEx
GetVersionExA
GetCurrentProcess
OutputDebugStringA
CreateRemoteThread
WriteProcessMemory
WriteFile
GlobalFree
GlobalAlloc
DeleteFileA
FreeLibraryAndExitThread
MoveFileExA
GetTempPathA
LoadLibraryA
GetProcAddress
GetLastError
FreeLibrary
ExpandEnvironmentStringsA
Sleep
GetTickCount
CreateFileA
GetFileSize
ReadFile
CloseHandle
CreateThread
GetModuleFileNameA
CreateEventA
GetLongPathNameA
user32
wsprintfA
wsprintfW
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
RegisterServiceCtrlHandlerW
SetServiceStatus
CreateServiceA
RegCreateKeyExA
RegSetValueExA
StartServiceA
QueryServiceStatus
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
OpenSCManagerA
OpenServiceA
ControlService
DeleteService
CloseServiceHandle
CreateProcessAsUserA
SetTokenInformation
DuplicateTokenEx
OpenProcessToken
ws2_32
gethostbyname
inet_addr
WSAStartup
setsockopt
getsockopt
closesocket
connect
htons
socket
send
gethostname
recv
ntdll
RtlInitUnicodeString
_strcmpi
RtlEqualUnicodeString
NtQueryObject
NtQuerySystemInformation
wtsapi32
WTSEnumerateSessionsA
Exports
Exports
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
... Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1010B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ