c:\work\0047.BHO\bho\BHO_full_tbws\release\vmmreg32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
05d23c63e000ab18fa8619dc06471950_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
05d23c63e000ab18fa8619dc06471950_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
05d23c63e000ab18fa8619dc06471950_JaffaCakes118
-
Size
280KB
-
MD5
05d23c63e000ab18fa8619dc06471950
-
SHA1
c84a1ed78950dfbcdd286d6c454352bf4bd98129
-
SHA256
c74149e64e9f65d5eb66ff14361c03f24489ce46632713b1f292a191e550a9e7
-
SHA512
677e6f4d777fabac90a81f69afb9509656269eac6d528e04399f445a66a9275cd3405c11ce9270c72da2fba9b146aa64d1df44d4d8e6645edc2ee2ff1f9138b5
-
SSDEEP
3072:54+GrO1PAtorn5qU8B2xApPWKMpsJRnSfKhg80/vwahq0RKnLtWdVWXQDDk1N:+XrOWs5TkuK9n2Ki80wa5wnwXRc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 05d23c63e000ab18fa8619dc06471950_JaffaCakes118
Files
-
05d23c63e000ab18fa8619dc06471950_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
bb8462a29560546ff928a7334abf6fd5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
winhttp
WinHttpSetDefaultProxyConfiguration
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
psapi
EnumProcessModules
EnumProcesses
GetModuleFileNameExW
kernel32
LockResource
LoadResource
FindResourceW
FindResourceExW
MultiByteToWideChar
GlobalFree
GetLastError
Sleep
GetWindowsDirectoryW
DeleteFileW
FreeLibrary
GetCurrentProcess
GetProcAddress
LoadLibraryW
OpenProcess
lstrlenA
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
lstrcmpiW
GetModuleFileNameW
FindClose
FindNextFileW
FindFirstFileW
CreateDirectoryW
WaitForMultipleObjects
FindFirstChangeNotificationW
CreateEventW
InterlockedIncrement
InterlockedDecrement
LoadLibraryExW
GetModuleHandleW
SetThreadLocale
GetThreadLocale
CreateThread
GetModuleHandleExW
SizeofResource
WaitForSingleObject
SetFilePointer
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileAttributesW
GetCurrentDirectoryW
SetFileTime
FileTimeToSystemTime
GetFileSize
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingW
GetLocalTime
UnmapViewOfFile
GetTickCount
InterlockedExchange
GetACP
GetLocaleInfoA
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetStringTypeW
GetStringTypeA
lstrlenW
WriteFile
WideCharToMultiByte
SetEnvironmentVariableA
CreateFileW
ReadFile
CloseHandle
GetExitCodeProcess
CreateProcessA
GetFileAttributesA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
CompareStringA
CompareStringW
DisableThreadLibraryCalls
LoadLibraryA
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
GetOEMCP
GetCPInfo
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapCreate
VirtualAlloc
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
VirtualFree
user32
CharNextW
wsprintfW
UnregisterClassA
GetDesktopWindow
advapi32
CloseServiceHandle
RegEnumKeyExW
GetUserNameW
RegEnumValueW
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegNotifyChangeKeyValue
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegSaveKeyW
CreateServiceW
OpenSCManagerW
OpenServiceW
StartServiceW
RegCreateKeyW
RegRestoreKeyW
RegCloseKey
ole32
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
oleaut32
VarUI4FromStr
SysFreeString
SysAllocString
LoadTypeLi
LoadRegTypeLi
DispCallFunc
VariantClear
VariantInit
RegisterTypeLi
SysStringLen
shlwapi
SHRegCreateUSKeyW
SHDeleteKeyW
SHRegSetUSValueW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllRunThreads
DllUnregisterServer
Sections
.text Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ