ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
b86e89a42a1c1bc6ea15096c68e38ba4_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b86e89a42a1c1bc6ea15096c68e38ba4_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b86e89a42a1c1bc6ea15096c68e38ba4_JaffaCakes118
-
Size
40KB
-
MD5
b86e89a42a1c1bc6ea15096c68e38ba4
-
SHA1
83f1edf415e680f50da1f32ba1580e81f16aac5e
-
SHA256
73f813458bd5f9ed03ffba06abc6f93afa816cd497795d22a658367976fe4c82
-
SHA512
3f2c496e4399d1fb39a40f3563663291f07bcee4c3d3bde6c3a6e86efab4df97166c7c3ff7eeced84992ec6f7d8c49ef98cd6da64d78cc4da2c926434b7a28c0
-
SSDEEP
384:4vESdmXK70LxuhocEicXY34zBpYqCQzzM9rZ1iTNNv7zMroa6O9oHiyAfKpi:4vESQ67yuhocEicznYqerZoOrrQNQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b86e89a42a1c1bc6ea15096c68e38ba4_JaffaCakes118
Files
-
b86e89a42a1c1bc6ea15096c68e38ba4_JaffaCakes118.dll windows:4 windows x86 arch:x86
4eb469b8499b122a56301f92d8e10466
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
_CxxThrowException
strlen
memmove
memcpy
memset
strcpy
fseek
fopen
fread
realloc
strcat
_except_handler3
_strnicmp
_wcsnicmp
_adjust_fdiv
_initterm
free
_onexit
__dllonexit
strncmp
sprintf
malloc
_ftol
time
srand
rand
fclose
atof
sscanf
_endthreadex
atoi
__CxxFrameHandler
strncpy
wcstombs
??2@YAPAXI@Z
_beginthreadex
??3@YAXPAX@Z
??1type_info@@UAE@XZ
ws2_32
WSACloseEvent
gethostname
send
WSAGetLastError
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAResetEvent
ioctlsocket
recv
WSAStartup
WSASocketA
inet_addr
gethostbyname
inet_ntoa
htons
connect
WSAEventSelect
WSACreateEvent
shutdown
closesocket
WSACleanup
msvcp60
??_7?$basic_fstream@DU?$char_traits@D@std@@@std@@6B@
?_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@12@@Z
??_7?$basic_filebuf@DU?$char_traits@D@std@@@std@@6B@
??0locale@std@@QAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??0ios_base@std@@IAE@XZ
??_8?$basic_fstream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@
??_8?$basic_fstream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Initcvt@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?__Fiopen@std@@YAPAU_iobuf@@PBDH@Z
?clear@ios_base@std@@QAEXH_N@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??1?$basic_fstream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Fpz@std@@3_JB
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?close@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1locale@std@@QAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1ios_base@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
crypt32
CertGetCertificateChain
CertFreeCertificateChain
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
kernel32
lstrlenA
lstrcpynA
GetStartupInfoA
GetLastError
GetCurrentProcess
DuplicateHandle
GetEnvironmentVariableA
CreateProcessA
CreatePipe
WriteFile
ExitThread
MultiByteToWideChar
ReadFile
CreateThread
TerminateThread
TerminateProcess
DisconnectNamedPipe
HeapAlloc
HeapFree
GetProcessHeap
CloseHandle
WaitForMultipleObjects
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExA
OutputDebugStringA
CreateEventA
SetEvent
WaitForSingleObject
ResetEvent
Sleep
GetModuleFileNameA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
GetModuleHandleA
OpenProcess
PeekNamedPipe
GetTickCount
advapi32
AdjustTokenPrivileges
LogonUserA
CreateProcessAsUserA
SetServiceStatus
RegisterServiceCtrlHandlerA
GetTokenInformation
LookupAccountSidA
OpenProcessToken
LookupPrivilegeValueA
Exports
Exports
Sections
.text Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ