Static task
static1
Behavioral task
behavioral1
Sample
Osiris.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Osiris.dll
Resource
win10v2004-20240508-en
General
-
Target
8489afed62f995033527c8f088bcac05_JaffaCakes118
-
Size
447KB
-
MD5
8489afed62f995033527c8f088bcac05
-
SHA1
fb90d68088bc063c0cc52d2c3176b212083e7fde
-
SHA256
b5f4e7ec79aa3fe48372bb5e6d8f644151f2e6accad3989d3f4afe5e6207f92a
-
SHA512
c2e286f34c5c509bafc483e6f7a30432111cc0daf070978ba55bff52b20bd1b89a96f72834955c9dc9367ce4d8deeeb81b38f0bba1a2585991f441a88a586ca0
-
SSDEEP
12288:pFn3TJMu0mnK0P4WgjY4kZNG1kESN0y9VsM:pFnDau9KC4jYsKX0M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Osiris.dll
Files
-
8489afed62f995033527c8f088bcac05_JaffaCakes118.zip
-
Osiris.dll.dll windows:6 windows x86 arch:x86
7a4e406367b6a75c6df2fc56321e4cbd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
user32
LoadCursorA
ScreenToClient
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
GetKeyState
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
ShowWindow
FlashWindowEx
SetWindowLongA
CallWindowProcA
MessageBoxA
FindWindowW
GetAsyncKeyState
OpenClipboard
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext
kernel32
HeapReAlloc
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleW
SetStdHandle
GetUserDefaultLCID
IsValidLocale
HeapAlloc
HeapFree
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
GetFileType
GetStdHandle
HeapSize
WriteConsoleW
EnumSystemLocalesW
FindNextFileW
VirtualProtect
OutputDebugStringA
VirtualQuery
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
K32GetModuleInformation
GetProcAddress
GetModuleHandleW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
QueryPerformanceFrequency
QueryPerformanceCounter
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
RemoveDirectoryW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetLastError
SetLastError
MoveFileExW
FormatMessageW
GetStringTypeW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
GetFileSizeEx
RaiseException
InterlockedFlushSList
RtlUnwind
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
ReadFile
GetModuleFileNameW
Sections
.text Size: 705KB - Virtual size: 705KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 119KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Osiris.dll.sha1