DRMUserMgmt
Static task
static1
Behavioral task
behavioral1
Sample
0ea87ed2c58e3498d82a1f6e25a9e010_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0ea87ed2c58e3498d82a1f6e25a9e010_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
0ea87ed2c58e3498d82a1f6e25a9e010_JaffaCakes118
-
Size
152KB
-
MD5
0ea87ed2c58e3498d82a1f6e25a9e010
-
SHA1
e8d2f18fcd960a67297d837c88fcd53a00c5fdfc
-
SHA256
f61c0e9c5c75528704e8a4f8e8b615dd524e85a7c7650082f18ec6fa8e1409f9
-
SHA512
b24a1803732f2c41010a0bee2f03a121137c7392357e115ed850297c600c59af7986491e9508da06c994603bcce3143ba0c2ff2922512f18529d6896e3124c79
-
SSDEEP
3072:xGBE65ZUjO10cKhkJSybWYCoem8BGDw/tUm56J:xGFZfr8kJSybh1pMl4J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ea87ed2c58e3498d82a1f6e25a9e010_JaffaCakes118
Files
-
0ea87ed2c58e3498d82a1f6e25a9e010_JaffaCakes118.dll windows:4 windows x86 arch:x86
851b36b314986f58312efdaca23292ff
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcess
SetLastError
GetModuleHandleA
GlobalAlloc
MapViewOfFile
Sleep
OpenFileMappingA
WriteFile
CreateProcessA
GetVolumeInformationA
HeapFree
CloseHandle
GetComputerNameA
WaitForSingleObject
UnmapViewOfFile
LocalFree
WriteProcessMemory
GetModuleFileNameA
GetLastError
GetTickCount
InterlockedCompareExchange
GetCommandLineA
LeaveCriticalSection
CopyFileA
EnterCriticalSection
CreateFileMappingA
ReadProcessMemory
ExitProcess
GetProcessHeap
CreateMutexW
HeapAlloc
OpenEventA
TerminateProcess
CreateFileA
LoadLibraryA
GetProcAddress
GlobalFree
CreateEventA
CreateDirectoryA
InterlockedIncrement
InterlockedDecrement
ole32
CoUninitialize
CoCreateGuid
OleCreate
CoSetProxyBlanket
CoTaskMemAlloc
CoCreateInstance
OleSetContainedObject
CoInitialize
user32
PeekMessageA
SetWindowLongA
KillTimer
ClientToScreen
GetWindowLongA
GetSystemMetrics
GetCursorPos
ScreenToClient
DefWindowProcA
DispatchMessageA
TranslateMessage
SetWindowsHookExA
DestroyWindow
GetWindow
SendMessageA
SetTimer
GetWindowThreadProcessId
PostQuitMessage
UnhookWindowsHookEx
CreateWindowExA
FindWindowA
GetParent
RegisterWindowMessageA
GetClassNameA
GetMessageA
oleaut32
SysFreeString
SysAllocString
SysStringLen
SysAllocStringLen
shlwapi
UrlUnescapeW
StrStrIW
advapi32
DuplicateTokenEx
OpenProcessToken
RegQueryValueExA
RegDeleteValueA
RegOpenKeyExA
GetUserNameA
RegDeleteKeyA
SetTokenInformation
RegCreateKeyExA
RegSetValueExA
RegCloseKey
shell32
SHGetFolderPathA
Exports
Exports
Sections
.text Size: 124KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 937B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ