ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
faf2fa755f1098da232ba33040587db1_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
faf2fa755f1098da232ba33040587db1_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
faf2fa755f1098da232ba33040587db1_JaffaCakes118
-
Size
81KB
-
MD5
faf2fa755f1098da232ba33040587db1
-
SHA1
37ceb2bc2466e2ae76449ac68b92b6d4bc287c9b
-
SHA256
52ea179d99f47aa8173c7f8897c3f09114670022f1bf90c617dd6d6de8f88d90
-
SHA512
7546acba8cf0e546bfd740bbc5cd828cd81ad8d15766db17d0f6997a25659e769fa19c05155357df0e9a4176b02e6b1ce0e53e0c78a225982308880cf8cb24e5
-
SSDEEP
1536:Y+dgyg/zmnG8lv1EDpcDyg3fm18aztaWlJPVPssGu:Y+Oyga3QDpsyem18SlJPVPssG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource faf2fa755f1098da232ba33040587db1_JaffaCakes118
Files
-
faf2fa755f1098da232ba33040587db1_JaffaCakes118.dll windows:4 windows x86 arch:x86
26007e66634905ad679b44991be757fa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateProcessA
GetTempPathA
MoveFileExA
GetTickCount
GetLocalTime
GetModuleHandleA
GetCurrentThreadId
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
InterlockedExchange
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
GetLastError
SetLastError
OpenEventA
SetErrorMode
SetUnhandledExceptionFilter
FreeConsole
LocalSize
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
lstrcmpiA
GetSystemDirectoryA
GetFileAttributesA
MoveFileA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
CreateEventA
CloseHandle
TerminateThread
lstrcpyA
ResetEvent
WaitForSingleObject
SetEvent
CancelIo
Sleep
lstrlenA
GetPrivateProfileSectionNamesA
lstrcatA
InitializeCriticalSection
GetWindowsDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetVersionExA
DeleteFileA
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
RemoveDirectoryA
LocalAlloc
user32
EnumWindows
GetWindowThreadProcessId
ExitWindowsEx
OpenInputDesktop
IsWindow
CloseWindow
GetCursorPos
ReleaseDC
CreateWindowExA
GetUserObjectInformationA
GetSystemMetrics
SetRect
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
mouse_event
SetCursorPos
WindowFromPoint
SetCapture
MapVirtualKeyA
keybd_event
GetDC
GetDesktopWindow
wsprintfA
GetWindowTextA
GetActiveWindow
GetKeyNameTextA
GetFocus
IsWindowVisible
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
CloseDesktop
CloseWindowStation
PostMessageA
SystemParametersInfoA
SendMessageA
GetProcessWindowStation
GetThreadDesktop
OpenWindowStationA
SetProcessWindowStation
OpenDesktopA
SetThreadDesktop
gdi32
CreateCompatibleDC
GetPaletteEntries
SelectObject
DeleteObject
DeleteDC
BitBlt
CreateDIBSection
CreateHalftonePalette
advapi32
GetTokenInformation
LookupAccountSidA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
SetServiceStatus
RegisterServiceCtrlHandlerExA
RegCreateKeyA
RegSetValueExA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegOpenKeyA
RegQueryValueExA
OpenEventLogA
ClearEventLogA
CloseEventLog
RegOpenKeyExA
RegQueryValueA
RegCloseKey
LsaFreeMemory
LsaOpenPolicy
LsaRetrievePrivateData
LsaClose
LookupAccountNameA
IsValidSid
shell32
SHGetSpecialFolderPathA
SHGetFileInfoA
shlwapi
SHDeleteKeyA
msvcrt
strrchr
realloc
atoi
_except_handler3
strncpy
wcstombs
malloc
calloc
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
strchr
_CxxThrowException
??2@YAPAXI@Z
__CxxFrameHandler
strstr
_ftol
_strcmpi
ceil
memmove
_beginthreadex
??3@YAXPAX@Z
free
ws2_32
socket
htons
gethostname
setsockopt
getsockname
WSACleanup
WSAStartup
connect
ntohs
recv
send
select
closesocket
gethostbyname
msvcp60
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
dbghelp
MakeSureDirectoryPathExists
imm32
ImmReleaseContext
ImmGetContext
ImmGetCompositionStringA
wininet
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
urlmon
URLDownloadToFileA
avicap32
capCreateCaptureWindowA
psapi
GetModuleFileNameExA
EnumProcessModules
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationA
Exports
Exports
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ