ServiceRouteExA
Static task
static1
Behavioral task
behavioral1
Sample
0f19dc828aa95dcbc82b1bd6526d22c2_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0f19dc828aa95dcbc82b1bd6526d22c2_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0f19dc828aa95dcbc82b1bd6526d22c2_JaffaCakes118
-
Size
16KB
-
MD5
0f19dc828aa95dcbc82b1bd6526d22c2
-
SHA1
7b0126525b5d84058337a33ebdc331707a12f693
-
SHA256
d7d1ec01b14d9339eac2fb5c8e55ccea3f2eb74160d29a6e4065dc32c26bea8c
-
SHA512
38585e7484699b9995321e70d66f4714b59bcbe90b438afed7dfba6e6ee4bd69efa6af69b202dd1f3bf11f0a9deefeda109e1aca9f20f276c9573b5cca3c8c3c
-
SSDEEP
192:FWmL648MU6Ff5+/onjv4ahfzMC3usGZ4xaKuBBQ6PRQksB1d1XLGpjKX:8C6mU6F8ahI0uNaoKuBBQARQksB1nGo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f19dc828aa95dcbc82b1bd6526d22c2_JaffaCakes118
Files
-
0f19dc828aa95dcbc82b1bd6526d22c2_JaffaCakes118.dll windows:4 windows x86 arch:x86
06d56a2f8a4b9fa9651397f63130173e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
gethostname
closesocket
ntdll
RtlZeroMemory
strstr
memcmp
memcpy
strlen
kernel32
LeaveCriticalSection
CreateFileA
lstrlenA
lstrcpyA
lstrcmpiA
lstrcmpA
lstrcatA
WaitForSingleObject
TerminateThread
lstrcpynA
GetCommandLineA
VirtualProtectEx
ReadFile
GetFileSize
CloseHandle
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
InitializeCriticalSection
Sleep
LoadLibraryA
GetExitCodeThread
user32
wsprintfA
EnumWindows
GetWindowTextA
GetWindowThreadProcessId
KillTimer
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
Exports
Exports
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 4B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 586B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ