jaovu
Static task
static1
Behavioral task
behavioral1
Sample
3b77ee711a05f071921db953a3940faa_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
3b77ee711a05f071921db953a3940faa_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/svlainqhst.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/svlainqhst.dll
Resource
win10v2004-20240226-en
General
-
Target
3b77ee711a05f071921db953a3940faa_JaffaCakes118
-
Size
245KB
-
MD5
3b77ee711a05f071921db953a3940faa
-
SHA1
5e52987822de91b6b7697534bdce76c122c3cce7
-
SHA256
00f8d8ce7174e6eaac21ce3278ea4795ed859996c8d09bf6ad189b892fc5e144
-
SHA512
3cf3ea9bce0c6ecbaee11e613e7bca2f65b34f75068beb0f01f619d8b7cc643fc392bd0842277a1ef4e2d953a24f35b68c41a040c83c41aa858a5796a838600b
-
SSDEEP
6144:wBlL/cTGU08fsbTu9tbxM3uimcKrFe8N0k:CeTGz8fGqrbxpckT
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 3b77ee711a05f071921db953a3940faa_JaffaCakes118 unpack001/$PLUGINSDIR/svlainqhst.dll -
NSIS installer 2 IoCs
resource yara_rule sample nsis_installer_1 sample nsis_installer_2
Files
-
3b77ee711a05f071921db953a3940faa_JaffaCakes118.exe windows:4 windows x86 arch:x86
b76363e9cb88bf9390860da8e50999d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
SetFileAttributesA
CompareFileTime
SearchPathA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
GetTempPathA
Sleep
lstrcmpiA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrcatA
GetSystemDirectoryA
WaitForSingleObject
SetFileTime
CloseHandle
GlobalFree
lstrcmpA
ExpandEnvironmentStringsA
GetExitCodeProcess
GlobalAlloc
lstrlenA
GetCommandLineA
GetProcAddress
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
ReadFile
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
WriteFile
MulDiv
MultiByteToWideChar
LoadLibraryExA
GetModuleHandleA
FreeLibrary
user32
SetCursor
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
EndDialog
ScreenToClient
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetForegroundWindow
GetWindowLongA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
SetTimer
PostQuitMessage
SetWindowLongA
SendMessageTimeoutA
LoadImageA
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
CreateDialogParamA
DestroyWindow
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
ShellExecuteA
advapi32
RegDeleteValueA
SetFileSecurityA
RegOpenKeyExA
RegDeleteKeyA
RegEnumValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_AddMasked
ImageList_Destroy
ImageList_Create
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/svlainqhst.dll.dll windows:6 windows x86 arch:x86
44acdb9da6379974ac92c634a8a80970
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
shlwapi
PathFindExtensionA
PathRelativePathToW
SHDeleteValueW
SHRegOpenUSKeyA
StrCSpnIW
StrStrIW
StrTrimA
kernel32
CloseHandle
CreateFileW
DisableThreadLibraryCalls
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FreeLibrary
GetDriveTypeA
GetDriveTypeW
GetLastError
GetProcAddress
GetProcessHeap
GetStringTypeW
GetVersion
HeapAlloc
HeapFree
LoadLibraryW
MultiByteToWideChar
SetConsoleWindowInfo
SetLastError
VirtualProtect
VirtualQuery
WideCharToMultiByte
lstrcmpW
lstrcpyA
lstrcpyW
lstrlenA
lstrlenW
odbc32
ord210
ord31
ord232
ord44
ord262
ord139
ord170
winmm
WOW32DriverCallback
auxSetVolume
midiInOpen
midiInUnprepareHeader
midiStreamPause
midiStreamPosition
mixerOpen
waveInAddBuffer
msi
ord7
ord15
ord17
ord18
ord31
ord34
ord169
ord56
ord80
ord92
ord123
ord139
ord146
mpr
MultinetGetConnectionPerformanceW
oleaut32
SafeArrayLock
VarDateFromR8
VarDecDiv
VarDecFromCy
VarDecFromDisp
VarDecFromUI2
VarImp
VarR8FromUI4
VarUI1FromDisp
VariantCopy
mscms
AssociateColorProfileWithDeviceW
CloseColorProfile
CreateProfileFromLogColorSpaceW
GetPS2ColorSpaceArray
GetStandardColorSpaceProfileW
IsColorProfileTagPresent
SelectCMM
SetColorProfileHeader
TranslateColors
gdi32
AddFontResourceA
AddFontResourceExA
CreateDIBSection
CreateEnhMetaFileA
DPtoLP
ExtFloodFill
GdiGetPageCount
GetOutlineTextMetricsW
OffsetViewportOrgEx
SetLayout
advapi32
GetUserNameA
GetUserNameW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenCurrentUser
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
user32
LoadStringW
msvcrt
_adjust_fdiv
_initterm
free
iswctype
malloc
memcpy
memset
strcpy
strlen
swprintf
wcschr
Exports
Exports
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
mcuee0c8wrpr