Static task
static1
Behavioral task
behavioral1
Sample
e14baa6dcaa2988bab71b3515c86a4d6_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
e14baa6dcaa2988bab71b3515c86a4d6_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
e14baa6dcaa2988bab71b3515c86a4d6_JaffaCakes118
-
Size
829KB
-
MD5
e14baa6dcaa2988bab71b3515c86a4d6
-
SHA1
80061f8305068783e277f94e9a9b112318001087
-
SHA256
fe934d10010073a7ebf3d52a5395d012bfe04319cb2f546b6c1d62bf2b32110d
-
SHA512
c619fd5d2e9274ff8ea9dc9d7026cd44bc003964d73fa2d90719754766fc995dfb1092007108e77654bc532dcacf48491a4d75cf303a1eacae8706ec72de69e4
-
SSDEEP
12288:3aw8aXkAqJvkbheVVmhywXTgPfsj/9HdsGaw8aXkAqJvkbheVVmhywXTgPfsj/96:eiYFwDKudsLiYFwDKudssLiYFwDKu
Malware Config
Signatures
Files
-
e14baa6dcaa2988bab71b3515c86a4d6_JaffaCakes118.dll regsvr32 windows:6 windows x86 arch:x86
73f0b3cfd42e8acbc7c47caaf14b35f7
Code Sign
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10/01/1997, 07:00Not After31/12/2020, 07:00SubjectCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before22/08/2007, 22:31Not After25/08/2012, 07:00SubjectCN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
61:0f:78:4d:00:00:00:00:00:03Certificate
IssuerCN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before23/08/2007, 00:23Not After23/02/2009, 00:33SubjectCN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
61:49:7c:ed:00:00:00:00:00:05Certificate
IssuerCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16/09/2006, 01:55Not After16/09/2011, 02:05SubjectCN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before16/09/2006, 01:04Not After15/09/2019, 07:00SubjectCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
d5:ed:2f:a4:c3:e1:bb:6c:a5:36:0c:7d:31:03:f9:fa:d0:79:4d:89Signer
Actual PE Digestd5:ed:2f:a4:c3:e1:bb:6c:a5:36:0c:7d:31:03:f9:fa:d0:79:4d:89Digest Algorithmsha1PE Digest MatchesfalseHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
XactEngine3_3.pdb
Imports
msvcrt
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
strlen
wcscmp
strncpy
fabs
cos
acos
free
malloc
??2@YAPAXI@Z
sin
memcpy
_purecall
strcmp
memcmp
_CIacos
_CIatan2
_CIcos
_CIsin
_CIsqrt
_CItan
pow
log10
??3@YAXPAX@Z
memset
user32
MessageBoxA
kernel32
WriteFile
SetEndOfFile
GetFileSize
SetFilePointer
GetTickCount
GetVersion
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
RtlUnwind
Sleep
DisableThreadLibraryCalls
GetModuleFileNameA
GetLastError
SetEvent
WaitForSingleObject
WaitForMultipleObjects
CreateEventA
CreateThread
TryEnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedExchange
CreateFileA
CloseHandle
IsProcessorFeaturePresent
ReadFile
GetOverlappedResult
QueryPerformanceFrequency
HeapAlloc
OutputDebugStringA
GetCurrentThreadId
InterlockedCompareExchange
InterlockedIncrement
InterlockedDecrement
GetProcessHeap
HeapFree
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceCounter
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyExA
RegSetValueExA
rpcrt4
RpcStringFreeA
UuidToStringA
ole32
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 214KB - Virtual size: 213KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ