Static task
static1
Behavioral task
behavioral1
Sample
04b3036a0eb0bf37701919e94cbac292_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
04b3036a0eb0bf37701919e94cbac292_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
04b3036a0eb0bf37701919e94cbac292_JaffaCakes118
-
Size
36KB
-
MD5
04b3036a0eb0bf37701919e94cbac292
-
SHA1
14c83a987f878d158dfe3626f19a4e611e907fee
-
SHA256
0d8b773b576febe80f9bd55be1a8be8ec6745a9d33a30cf47b28b1fbd2b06437
-
SHA512
a55f3a30512cec7a7fead0da753ebfa9e267de3d7aa31bde332ca68f592dec6f640d13e1eb4982e0db98f34ddb650a1c474ad2c4ed554c3ba8179a5ca233b393
-
SSDEEP
384:6St9L7smezFQpNVSQdiSe0THSCm5E57kfX15Y8cDbpU93Lcp/93L0R08fum99eRK:PFsGf9W0bSC7kf6bpacph0R3fum+jzvC
Malware Config
Signatures
Files
-
04b3036a0eb0bf37701919e94cbac292_JaffaCakes118.dll windows:4 windows x86 arch:x86
dec64b410148f8175ade5dda816156c5
Code Sign
57:94:71:11:1d:3a:8c:b3:4b:67:fb:eb:0b:04:b5:02Certificate
IssuerCN=Root AgencyNot Before06/05/2010, 06:41Not After31/12/2039, 23:59SubjectCN=Microsofft VMM模块Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
lstrlenA
HeapDestroy
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
FlushInstructionCache
GetCurrentProcess
GetTickCount
Sleep
lstrcatA
GetProcAddress
GetFileAttributesA
GetWindowsDirectoryA
GetShortPathNameA
DebugBreak
OutputDebugStringA
lstrcpynW
lstrcpynA
EnterCriticalSection
GetVersionExA
GetCurrentThreadId
LeaveCriticalSection
InterlockedDecrement
GetSystemDirectoryA
user32
GetMenuItemInfoA
AppendMenuA
GetMenuItemCount
CreatePopupMenu
TrackPopupMenuEx
GetMonitorInfoA
MonitorFromPoint
IsWindow
MapWindowPoints
PtInRect
RemoveMenu
GetTopWindow
GetClassNameA
GetParent
GetWindow
SendMessageA
GetWindowTextA
GetClientRect
SetFocus
InvalidateRect
DestroyMenu
TranslateMessage
GetMessageA
CallWindowProcA
GetWindowLongA
GetCursorPos
GetWindowRect
SetCursorPos
mouse_event
GetDesktopWindow
SetForegroundWindow
KillTimer
PostMessageA
GetLastInputInfo
SetTimer
DefWindowProcA
TranslateAcceleratorA
GetClassInfoExA
LoadCursorA
wsprintfA
LoadImageA
RegisterClassExA
SetWindowLongA
CreateWindowExA
LoadStringA
LoadMenuA
DispatchMessageA
MessageBeep
LoadStringW
CharNextA
wvsprintfA
SetWindowPos
LoadAcceleratorsA
DestroyWindow
FindWindowA
ShowWindow
PeekMessageA
PostQuitMessage
advapi32
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
shell32
ShellExecuteA
SHGetSpecialFolderPathA
ole32
OleUninitialize
OleInitialize
msvcrt
atoi
isdigit
wcslen
strstr
_initterm
_purecall
??2@YAPAXI@Z
memmove
realloc
free
__CxxFrameHandler
strrchr
??3@YAXPAX@Z
malloc
_adjust_fdiv
time
shlwapi
PathFindFileNameA
Exports
Exports
Aetxml
BetDml
DllRundll
GetDDaa
setxml
sssweew
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 748B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ