InitHelperDll
Static task
static1
Behavioral task
behavioral1
Sample
c8d7dd8fa92ef7bedd9e4d568fd43332_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c8d7dd8fa92ef7bedd9e4d568fd43332_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c8d7dd8fa92ef7bedd9e4d568fd43332_JaffaCakes118
-
Size
26KB
-
MD5
c8d7dd8fa92ef7bedd9e4d568fd43332
-
SHA1
6c099285c17aa9852b91f8dfc56fd4772353ff05
-
SHA256
d53b1d9981d293ee2a4f6d60cbe29e182eb7242d36c6451e9c94f90610b4edb1
-
SHA512
4091ba193a8238f05ddf161d047ff60061b6636eacf673aebf1c6b462ae31a5b18ab93fd88f25b34f070f890811a87212a7a738d607c3f45bdbf3461c4f89664
-
SSDEEP
384:9gBVEF2dF1MYLIJYSnuHrrU/sY3qbZteqUXYxl4Sok0+h6u8pbW8AcWJw:9gmWcYLIJYlHE/sU0SlKlIIl8czJw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c8d7dd8fa92ef7bedd9e4d568fd43332_JaffaCakes118
Files
-
c8d7dd8fa92ef7bedd9e4d568fd43332_JaffaCakes118.dll windows:5 windows x86 arch:x86
7ddbb81db3870b95876c4f80e1a97338
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
free
wcscat
wcsncpy
calloc
wcscpy
__CxxFrameHandler
wcsstr
wcstok
_snwprintf
wcslen
_itow
wcsncat
msvcp60
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
ntdll
RtlCompressBuffer
RtlAllocateHeap
RtlGetCompressionWorkSpaceSize
RtlDecompressBuffer
RtlFreeHeap
advapi32
RegCloseKey
RegOpenKeyW
RegDeleteValueW
RegCreateKeyExW
RegCreateKeyW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
ControlService
kernel32
InterlockedIncrement
InterlockedDecrement
CloseHandle
GetCurrentProcess
DeleteFileW
UnmapViewOfFile
HeapFree
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
WriteFile
VirtualFree
DisableThreadLibraryCalls
VirtualAlloc
ReadFile
HeapAlloc
GetProcessHeap
netsh.exe
PrintMessageFromModule
RegisterHelper
PrintMessage
PrintError
MatchToken
MatchEnumTag
RegisterContext
ole32
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree
oleaut32
SysAllocString
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringLen
shlwapi
SHGetValueW
userenv
ExpandEnvironmentStringsForUserW
Exports
Exports
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 934B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ