ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
038039e8470b0a94a1216cb8910207a8_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
038039e8470b0a94a1216cb8910207a8_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
038039e8470b0a94a1216cb8910207a8_JaffaCakes118
-
Size
11KB
-
MD5
038039e8470b0a94a1216cb8910207a8
-
SHA1
7943a0535522618bba70430f6e2438a9c185c15e
-
SHA256
b077f3441dbec5e80e4b9039841b82c58098824c3c828323f661d0986e3c1ad1
-
SHA512
18260c5ed5335b6b1cfff134253084b18584417cb825aa774b38076ed27c26f0ca8abed152654a5ea679c2d7e4c65fccd476264aa8bef582ecac839f00374ae4
-
SSDEEP
192:OCXzldl0V7aXhMBZ9lbBdHZsCn3SG8SsuelKwZZ/uEjmhSWieTWyA6GQp:OCXzldl0xqad5sCn1sHlK2MEjmQWieTJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 038039e8470b0a94a1216cb8910207a8_JaffaCakes118
Files
-
038039e8470b0a94a1216cb8910207a8_JaffaCakes118.dll windows:4 windows x86 arch:x86
040adff7400b6c38e35fd53e08312551
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
MultiByteToWideChar
GetACP
GetVersionExW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetProcAddress
GetModuleHandleW
MoveFileExW
MoveFileW
DeleteFileW
GetSystemDirectoryW
Process32NextW
Process32FirstW
GetProcessHeap
TerminateProcess
OpenProcess
GetFileSize
WriteFile
CreateFileW
FreeLibrary
LoadLibraryW
ReadFile
PeekNamedPipe
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
HeapAlloc
HeapFree
WaitForSingleObject
Sleep
CreateThread
CloseHandle
CreateToolhelp32Snapshot
user32
wsprintfW
advapi32
SetServiceStatus
CloseServiceHandle
DeleteService
RegisterServiceCtrlHandlerW
OpenSCManagerW
OpenServiceW
shell32
ShellExecuteW
msvcrt
_adjust_fdiv
malloc
wcsncpy
memset
strcpy
memcpy
wcscat
wcscpy
swprintf
_wtoi
strlen
free
_initterm
ws2_32
closesocket
shutdown
WSACleanup
WSAStartup
recv
send
connect
htons
gethostbyname
socket
inet_ntoa
gethostname
Exports
Exports
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 642B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ