alrsvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ea43d9b8f19922fc656d682fccd65998_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ea43d9b8f19922fc656d682fccd65998_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ea43d9b8f19922fc656d682fccd65998_JaffaCakes118
-
Size
185KB
-
MD5
ea43d9b8f19922fc656d682fccd65998
-
SHA1
02eb3891a9d8f6b3a1e3e4447b82588fea67e15d
-
SHA256
8603ab0c8fdbacdb595d07b860a8eccd80fa8e31f9f06efd84b6c165dc4e92fe
-
SHA512
a50f27ec0091de6edb3886cb4c378b2405d6e2c4a651a6905242f847b3ecead5b57ad69ec362f75d7e8078fc3bd871aee31e875712cf3207cb9930fe25dac7b1
-
SSDEEP
3072:X+Luw3IXCKteV322w8z36E78AJwy4z36Bw+Sk2JVfGklUtYUpI7p333SdgIib7/:WNIXCK0G436E7PS6j2JVfTlKaN3Sy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea43d9b8f19922fc656d682fccd65998_JaffaCakes118
Files
-
ea43d9b8f19922fc656d682fccd65998_JaffaCakes118.dll windows:5 windows x86 arch:x86
b3dbf40a411c1aef0861279b4945de82
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_except_handler3
_itoa
strchr
strrchr
wcscpy
wcscat
wcsncpy
_wcsicmp
wcschr
wcslen
_ultoa
wcscmp
kernel32
Sleep
GetLastError
ReadFile
CloseHandle
LocalFree
CreateMailslotW
LocalAlloc
GetTimeFormatA
GetDateFormatA
GetThreadLocale
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
MultiByteToWideChar
WideCharToMultiByte
FormatMessageW
LoadLibraryExW
FreeLibrary
GetComputerNameExW
GetTimeZoneInformation
SetUnhandledExceptionFilter
netapi32
NetApiBufferFree
NetMessageBufferSend
I_NetNameCanonicalize
NetApiBufferAllocate
NetpIsRemote
I_NetNameCompare
advapi32
SetServiceStatus
RegQueryInfoKeyW
RegConnectRegistryW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegisterServiceCtrlHandlerW
ntdll
RtlNtStatusToDosError
RtlCopySid
RtlLengthSid
RtlSetSaclSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAce
RtlCreateAcl
RtlUnicodeStringToOemString
RtlxUnicodeStringToOemSize
NlsMbOemCodePageTag
RtlInitUnicodeString
RtlOemStringToUnicodeString
RtlxOemStringToUnicodeSize
RtlInitString
RtlInitAnsiString
Exports
Exports
ServiceMain
SvchostPushServiceGlobals
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 169KB - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ