Static task
static1
Behavioral task
behavioral1
Sample
0f482f1acabe3a980705d66cd6e4bf52_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0f482f1acabe3a980705d66cd6e4bf52_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0f482f1acabe3a980705d66cd6e4bf52_JaffaCakes118
-
Size
10KB
-
MD5
0f482f1acabe3a980705d66cd6e4bf52
-
SHA1
34af0e0532f89db5e987dad8c4a6041d6b65dca3
-
SHA256
8b0620a98b93e90d453f4e1441d8aea57c77dc5cda6648c6d982e7aa2351d53a
-
SHA512
57ea1ee595751fc217c52e5b5b3bf047888bfc4cf8e623f431eecca3b42f3a3fd2e21850cf262d11b116630c16845c8edb4f06848bffabb040eca816f95aadb3
-
SSDEEP
192:w/mo8OQYq78pn7Hjjso3HeFz3sjRQyhBhMj9qJKVHTfncuk2Bm4U3QE1a7:smT78pn7HjPeFwjjhkj9qJK5P5BmjQui
Malware Config
Signatures
Files
-
0f482f1acabe3a980705d66cd6e4bf52_JaffaCakes118.dll windows:1 windows x86 arch:x86
1d07c87f5f68e929912896a61205c5a0
Code Sign
6a:2f:41:41:61:66:4c:62:b4:27:e3:49:19:d4:a2:1fCertificate
IssuerCN=Root AgencyNot Before05/03/2010, 15:50Not After31/12/2039, 23:59SubjectCN=JinDiQIAO,OU=WWW.CeleWare.NET,O=CeleWare.NET,1.2.840.113549.1.9.1=#0c154a696e44695149414f40686f746d61696c2e636f6dSigner
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CopyFileA
CreateEventA
CreateThread
DeleteFileA
ExpandEnvironmentStringsA
GetLastError
GetModuleFileNameA
GetProcAddress
GetTempFileNameA
GetTempPathA
LoadLibraryA
MoveFileExA
RtlZeroMemory
VirtualAlloc
VirtualFree
lstrcmpiA
user32
GetMenu
GetMessageA
MessageBeep
MessageBoxA
Exports
Exports
CreateWindowA
DllCanUnloadNow
DllGetClassObject
MessageBoxA
lstrlen
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE