InitHelperDll
Static task
static1
Behavioral task
behavioral1
Sample
d615eee9a1378d0616907520b59a84a5_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d615eee9a1378d0616907520b59a84a5_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d615eee9a1378d0616907520b59a84a5_JaffaCakes118
-
Size
26KB
-
MD5
d615eee9a1378d0616907520b59a84a5
-
SHA1
443d765f15e1e999c50c5bda3416432d4dacc61e
-
SHA256
9ee581157b5af4ecfb4b1367245d74bc3ca78422403baefb89ffc685e1fc6552
-
SHA512
bf48bef5773c188a8c1862540bd5100a0b5f32c87d9200b9b4e012599523b6fba1d30403a0f7a527657d5f0ae49e4c86b42183d3543427a767618eed148da020
-
SSDEEP
384:kzVEdyPUojgtdn6DrTEn08XqJAqUXYxl4Sl+9q7mWbHJQ:Hy8ojgtIsn0QZlKld8iHJQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d615eee9a1378d0616907520b59a84a5_JaffaCakes118
Files
-
d615eee9a1378d0616907520b59a84a5_JaffaCakes118.dll windows:5 windows x86 arch:x86
7ddbb81db3870b95876c4f80e1a97338
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
free
wcscat
wcsncpy
calloc
wcscpy
__CxxFrameHandler
wcsstr
wcstok
_snwprintf
wcslen
_itow
wcsncat
msvcp60
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
ntdll
RtlCompressBuffer
RtlAllocateHeap
RtlGetCompressionWorkSpaceSize
RtlDecompressBuffer
RtlFreeHeap
advapi32
RegCloseKey
RegOpenKeyW
RegDeleteValueW
RegCreateKeyExW
RegCreateKeyW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
ControlService
kernel32
InterlockedIncrement
InterlockedDecrement
CloseHandle
GetCurrentProcess
DeleteFileW
UnmapViewOfFile
HeapFree
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
WriteFile
VirtualFree
DisableThreadLibraryCalls
VirtualAlloc
ReadFile
HeapAlloc
GetProcessHeap
netsh.exe
PrintMessageFromModule
RegisterHelper
PrintMessage
PrintError
MatchToken
MatchEnumTag
RegisterContext
ole32
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree
oleaut32
SysAllocString
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringLen
shlwapi
SHGetValueW
userenv
ExpandEnvironmentStringsForUserW
Exports
Exports
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 934B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ