InitHelperDll
Static task
static1
Behavioral task
behavioral1
Sample
d4c706dadbdb6a221013327a3127a4cf_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d4c706dadbdb6a221013327a3127a4cf_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d4c706dadbdb6a221013327a3127a4cf_JaffaCakes118
-
Size
339KB
-
MD5
d4c706dadbdb6a221013327a3127a4cf
-
SHA1
2e15bbe2f7b7d59f213f7f5d2659a4a6c0fe5fa9
-
SHA256
44b16a2bde2db31667e05cf8b07f5f44acaabbdf484425660a8f72bd722987d9
-
SHA512
4a8ab68c3d9ba79b5c1833f791733e3494bccd54c98b9b5fcf144ea2655fa66998868b032b308625a676aa3202403c2de42099058238086e4a0e35acf2105a9d
-
SSDEEP
3072:0nH/K9axaTsmJlvYVrAX5/R2tIf0YSS/dWgtbXd5Fylj8coMZr0/j9BxpZxu6Of3:0HfxaTsmJorY/Y6M0BBd5FznIZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d4c706dadbdb6a221013327a3127a4cf_JaffaCakes118
Files
-
d4c706dadbdb6a221013327a3127a4cf_JaffaCakes118.dll windows:5 windows x86 arch:x86
955088fc6f72f260b1fa666987f1ee00
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
atol
wcslen
fprintf
_iob
wcsncpy
_itow
wcscpy
_ultow
wcstoul
wcsstr
wcstok
free
_except_handler3
mbstowcs
_wtol
wcstombs
memmove
vsprintf
wcscat
malloc
_stricmp
sprintf
isalpha
_wcsnicmp
strtok
tolower
_itoa
toupper
isdigit
calloc
wcscmp
_wcsicmp
wcsncmp
wcstol
iswctype
putchar
_wtoi
wcsncat
ntdll
RtlRunEncodeUnicodeString
RtlOemStringToUnicodeString
RtlInitString
RtlxOemStringToUnicodeSize
NlsMbOemCodePageTag
RtlUnicodeStringToOemString
RtlxUnicodeStringToOemSize
RtlInitUnicodeString
NtSetInformationThread
RtlAdjustPrivilege
RtlNtStatusToDosError
DbgPrint
RtlImpersonateSelf
dhcpsapi
DhcpEnumOptionsV5
DhcpCreateOptionV5
DhcpDsCleanup
DhcpGetVersion
DhcpDsInit
DhcpAddServer
DhcpDeleteServer
DhcpRpcFreeMemory
DhcpEnumServers
DhcpSetThreadOptions
DhcpGetOptionValue
DhcpEnumMScopeElements
DhcpGetMScopeInfo
DhcpGetSuperScopeInfoV4
DhcpEnumOptionValues
DhcpGetAllOptionValues
DhcpGetClientInfoV4
DhcpEnumSubnetElementsV4
DhcpEnumOptions
DhcpEnumSubnetElementsV5
DhcpEnumSubnetElements
DhcpGetSubnetInfo
DhcpEnumMScopes
DhcpEnumSubnets
DhcpServerGetConfigV4
DhcpGetOptionValueV5
DhcpAuditLogGetParams
DhcpGetAllOptions
DhcpEnumClasses
DhcpSetOptionValue
DhcpAddMScopeElement
DhcpSetMScopeInfo
DhcpDeleteMScope
DhcpScanMDatabase
DhcpRemoveMScopeElement
DhcpGetOptionInfo
DhcpGetOptionInfoV5
DhcpGetMCastMibInfo
DhcpEnumOptionValuesV5
DhcpEnumMScopeClients
DhcpAddSubnetElementV5
DhcpAddSubnetElement
DhcpScanDatabase
DhcpRemoveSubnetElement
DhcpRemoveSubnetElementV5
DhcpRemoveSubnetElementV4
DhcpSetSubnetInfo
DhcpSetSuperScopeV4
DhcpRemoveOptionValue
DhcpRemoveOptionValueV5
DhcpSetOptionValueV5
DhcpSetClientInfoV4
DhcpAddSubnetElementV4
DhcpEnumSubnetClientsV4
DhcpEnumSubnetClientsV5
DhcpCreateClass
DhcpCreateSubnet
DhcpDeleteClass
DhcpRemoveOptionV5
DhcpRemoveOption
DhcpDeleteSubnet
DhcpDeleteSuperScopeV4
DhcpServerRedoAuthorization
DhcpServerSetConfigV4
DhcpServerSetConfig
DhcpServerSetDnsRegCredentials
DhcpAuditLogSetParams
DhcpGetServerBindingInfo
DhcpServerQueryAttribute
DhcpGetMibInfo
DhcpServerQueryDnsRegCredentials
DhcpCreateOption
kernel32
DeleteCriticalSection
SetCurrentDirectoryW
GetProcAddress
GetLastError
GetComputerNameExW
FreeLibrary
DisableThreadLibraryCalls
InterlockedDecrement
LocalFree
LocalAlloc
WideCharToMultiByte
LoadLibraryW
FormatMessageW
HeapAlloc
GetProcessHeap
InterlockedIncrement
IsBadStringPtrW
FileTimeToSystemTime
FileTimeToLocalFileTime
SetConsoleMode
GetConsoleMode
GetStdHandle
CloseHandle
CreateFileW
MultiByteToWideChar
SetLastError
HeapFree
DeleteFileW
Sleep
SetCurrentDirectoryA
GetVersion
ExpandEnvironmentStringsA
FindFirstFileA
ReadConsoleW
FindNextFileA
FindClose
GetModuleHandleW
GetFileSize
CreateFileMappingW
InitializeCriticalSection
GetVersionExW
GetCurrentDirectoryW
WriteFile
GetLocaleInfoW
GetDateFormatW
GetTimeFormatW
GetLocaleInfoA
GetSystemTime
SystemTimeToFileTime
UnmapViewOfFile
MapViewOfFile
netsh.exe
MatchToken
MatchCmdLine
RegisterContext
RegisterHelper
PrintMessageFromModule
user32
CharToOemA
wsprintfW
ws2_32
WSAGetLastError
ntohl
gethostbyaddr
inet_addr
WSAStartup
htonl
inet_ntoa
gethostbyname
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExA
CloseServiceHandle
ControlService
QueryServiceStatus
OpenServiceW
OpenSCManagerW
StartServiceW
RegRestoreKeyW
RegSaveKeyW
RegDeleteKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumValueW
RegSetValueExW
Exports
Exports
Sections
.text Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rӇ� Size: 230KB - Virtual size: 1590.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ