Static task
static1
Behavioral task
behavioral1
Sample
1340b0f81c1d4acfe3f52c09429eaf9a_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1340b0f81c1d4acfe3f52c09429eaf9a_JaffaCakes118.dll
Resource
win10v2004-20240419-en
General
-
Target
1340b0f81c1d4acfe3f52c09429eaf9a_JaffaCakes118
-
Size
315KB
-
MD5
1340b0f81c1d4acfe3f52c09429eaf9a
-
SHA1
4a12a011efd56757c0c88287c8525b1e2fdbaac5
-
SHA256
6b0a3abed05fc14fef3fe0672c7511d5c1206dc5b8a040ad81b69a904d86d06d
-
SHA512
1c5315650b6787d05f9f8727c8e7c041ac954cb67617f85a6136cab132ad9eeb08529e658d5333d8e5f1199ccc1a428cd1f5b15a434bff9bb7503617aee38fb8
-
SSDEEP
6144:pXRH2b+pdzJizKW8aJOdEd3TytC5lBcojt7dSWzlewGBMPkx:REb+pdKKHayEdrVdHckkx
Malware Config
Signatures
Files
-
1340b0f81c1d4acfe3f52c09429eaf9a_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
1c1ec91e90a5bd72b302e5093fe1bcd6
Code Sign
3c:91:31:cb:1f:f6:d0:1b:0e:9a:b8:d0:44:bf:12:beCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before29/01/1996, 00:00Not After02/08/2028, 23:59SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before08/11/2006, 00:00Not After07/11/2021, 23:59SubjectCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
5c:2f:97:a3:1a:bc:32:b0:8c:ac:01:00:59:8f:32:f6Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before16/11/2011, 00:00Not After15/12/2012, 23:59SubjectCN=Neowiz CORPORATION,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Neowiz CORPORATION,L=Gangnam,ST=Seoul,C=KRExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
IsBadReadPtr
IsBadCodePtr
GetOEMCP
GetCPInfo
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
HeapSize
TerminateProcess
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
GetCommandLineA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapReAlloc
RtlUnwind
ExitProcess
FindClose
LockResource
WriteFile
RemoveDirectoryA
FindFirstFileA
FindNextFileA
LoadLibraryA
GetProcAddress
GetModuleHandleA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
IsDBCSLeadByte
lstrcatA
GetModuleFileNameA
lstrcpyA
DisableThreadLibraryCalls
QueryPerformanceFrequency
QueryPerformanceCounter
GetLastError
WaitForSingleObject
lstrlenW
CopyFileA
WideCharToMultiByte
lstrcpynA
GetExitCodeThread
SuspendThread
Sleep
ResumeThread
SetThreadPriority
CreateThread
CreateFileA
GetFileSize
CloseHandle
lstrcmpiA
HeapFree
GetLocalTime
GetCurrentThreadId
DeleteFileA
MultiByteToWideChar
GetTickCount
OutputDebugStringA
DebugBreak
InterlockedIncrement
InterlockedDecrement
lstrcmpA
GetStringTypeExA
lstrlenA
CreateDirectoryA
GetProcessHeap
HeapAlloc
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
user32
SetWindowTextA
wsprintfA
GetClassInfoExA
IsWindowEnabled
DrawEdge
RegisterClassExA
PostMessageA
PeekMessageA
ReleaseCapture
InvertRect
LoadBitmapA
SetWindowLongA
CopyRect
InflateRect
LoadStringA
CharNextA
SendMessageA
PostThreadMessageA
CharLowerA
wvsprintfA
DrawTextA
UnregisterClassA
GetKeyState
PtInRect
GetDC
DialogBoxParamA
UnionRect
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
IsChild
GetFocus
ShowWindow
GetCursorPos
MoveWindow
SetCursor
GetCursor
MessageBoxA
GetActiveWindow
CreateDialogParamA
SetCapture
GetSystemMetrics
DrawFocusRect
ClientToScreen
GetWindowRect
GetDlgCtrlID
GetCapture
KillTimer
SystemParametersInfoA
SetTimer
DestroyWindow
InvalidateRect
UpdateWindow
CallWindowProcA
EndPaint
BeginPaint
DefWindowProcA
GetParent
IsWindow
AdjustWindowRectEx
GetDlgItem
SetFocus
ReleaseDC
GetClientRect
SetWindowPos
GetMenu
GetWindowTextA
CreateWindowExA
GetWindowLongA
EndDialog
LoadCursorA
gdi32
GetDeviceCaps
CreateFontA
GetObjectA
CreateBitmap
TextOutA
GetClipBox
CreateRoundRectRgn
FrameRgn
CreateDCA
LPtoDP
SetMapMode
SetViewportOrgEx
CreateMetaFileA
SaveDC
SetWindowOrgEx
SetWindowExtEx
RestoreDC
SelectObject
SetBkColor
SetBkMode
SetTextColor
MoveToEx
LineTo
PolyBezier
Ellipse
Rectangle
RoundRect
GetPixel
SetPixel
ExtFloodFill
GetTextExtentPoint32A
ExtTextOutA
CreateSolidBrush
CreatePatternBrush
DeleteObject
CreateCompatibleDC
BitBlt
StretchBlt
CreateCompatibleBitmap
DeleteDC
CreatePen
CreateFontIndirectA
GetStockObject
EnumFontFamiliesA
CloseMetaFile
CreateRectRgnIndirect
DeleteMetaFile
GetObjectType
comdlg32
GetOpenFileNameA
GetSaveFileNameA
advapi32
RegOpenKeyExA
RegSetValueExA
RegEnumKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegQueryInfoKeyA
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderPathA
ole32
CreateOleAdviseHolder
CreateDataAdviseHolder
OleRegGetMiscStatus
OleRegGetUserType
OleRegEnumVerbs
StringFromGUID2
WriteClassStm
OleSaveToStream
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoUninitialize
OleLoadFromStream
oleaut32
UnRegisterTypeLi
OleCreatePropertyFrame
SysStringLen
LoadRegTypeLi
VariantChangeType
VarUI4FromStr
RegisterTypeLi
LoadTypeLi
SysAllocString
OleLoadPicturePath
SysAllocStringLen
VariantClear
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysFreeString
btnexgenipl32
?Create@BTCImageData@@QAE_NHHH@Z
?Fill@BTCImageData@@QAE_NHHHHK@Z
?GetObjectData@BTCImageObject@@QBE?AVBTCImageData@@XZ
?Attach@BTCImageObject@@QAE_NAAVBTCImageData@@@Z
?ConvertTo24BPP@BTCImageData@@QAE_NXZ
?Grayscale@BTCImageData@@QAE_NXZ
?AdjustHLS@BTCImageData@@QAE_NHHH@Z
?AdjustRGB@BTCImageData@@QAE_NHHH@Z
?AdjustBrightness@BTCImageData@@QAE_NH@Z
?AdjustContrast@BTCImageData@@QAE_NH@Z
?Smooth@BTCImageData@@QAE_NH@Z
?Sharpen@BTCImageData@@QAE_NXZ
?Combine@BTCImageData@@QAE_NPAV1@W4BTCombineFunction@1@HHH_NHH@Z
?Crop@BTCImageData@@QAE_NHHHH@Z
?Flip@BTCImageData@@QAE_NXZ
?Mirror@BTCImageData@@QAE_NXZ
??0BTCHistogram@@QAE@XZ
??4BTCImageData@@QAEAAV0@AAV0@@Z
?GetMeanValue@BTCHistogram@@QBENABW4BTChannel@1@@Z
??1BTCHistogram@@UAE@XZ
??0BTCString@@QAE@PBD@Z
?GetCodecIdFromExtension@BTCImageObject@@QAEJVBTCString@@ABW4BTCodecType@@@Z
?Save@BTCImageObject@@QAEJVBTCString@@JPAVBTCEncoderOptions@@@Z
?GetHeight@BTCImageData@@QBEJXZ
?GetWidth@BTCImageData@@QBEJXZ
??0BTCImageData@@QAE@XZ
?Resize@BTCImageData@@QAE_NHHABW4BTResizeFilter@1@@Z
??1BTCImageData@@UAE@XZ
?FromHandle@BTCImageData@@QAE_NPAUHBITMAP__@@@Z
?Rotate90@BTCImageData@@QAE_NABW4BTDirection@1@@Z
??0BTCImageObject@@QAE@XZ
?Load@BTCImageObject@@QAEJPBDPAVBTCDecoderOptions@@PAX0@Z
?GetObjectDataPtr@BTCImageObject@@QAEPAVBTCImageData@@XZ
?Draw@BTCImageData@@QAEHPAUHDC__@@HHHHHHHK@Z
??1BTCImageObject@@UAE@XZ
?GetHistogram@BTCImageData@@QAE_NPAVBTCHistogram@@@Z
shlwapi
PathFindExtensionA
urlmon
URLDownloadToFileA
URLDownloadToCacheFileA
comctl32
ImageList_Destroy
ImageList_Add
_TrackMouseEvent
ImageList_Draw
ImageList_Create
ImageList_GetIconSize
msimg32
TransparentBlt
AlphaBlend
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 184KB - Virtual size: 182KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ