BthGLTray
Static task
static1
Behavioral task
behavioral1
Sample
2114d2785198e7e9b093c98741341af8_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2114d2785198e7e9b093c98741341af8_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
2114d2785198e7e9b093c98741341af8_JaffaCakes118
-
Size
140KB
-
MD5
2114d2785198e7e9b093c98741341af8
-
SHA1
1b11bc349c39296104270ec618af929b40804ac4
-
SHA256
583b12f6b59840a1c168b7b2471ba542234f2dd65db3d201602052813386caac
-
SHA512
1d32590a7557e9dfef084d303fbee4a73f606d85b5c2701112ce928094272411630999b85aa8fd5ac7d24c4877b82a8887d527564c041a0d4522e365989abefb
-
SSDEEP
3072:lNzyiQxoSiGqwI7Pza3MCtp9EZL647+TLV:/hQ6SiptWNB9nV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2114d2785198e7e9b093c98741341af8_JaffaCakes118
Files
-
2114d2785198e7e9b093c98741341af8_JaffaCakes118.dll windows:4 windows x86 arch:x86
688be62224f4c8ae1f1206ad604d95f5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LeaveCriticalSection
GetCurrentProcess
HeapAlloc
WriteProcessMemory
TerminateProcess
GetVolumeInformationA
CreateEventA
GetProcAddress
GetModuleFileNameA
GetProcessHeap
InterlockedIncrement
CopyFileA
GetCommandLineA
EnterCriticalSection
InterlockedCompareExchange
CreateMutexW
GetModuleHandleA
CloseHandle
SetLastError
HeapFree
GetTickCount
CreateFileA
LocalFree
OpenEventA
GetComputerNameA
MapViewOfFile
OpenFileMappingA
UnmapViewOfFile
GlobalAlloc
CreateProcessA
Sleep
LoadLibraryA
ReadProcessMemory
CreateDirectoryA
InterlockedDecrement
GlobalFree
GetLastError
ExitProcess
WaitForSingleObject
CreateFileMappingA
WriteFile
ole32
CoTaskMemAlloc
CoInitialize
OleCreate
CoSetProxyBlanket
CoCreateInstance
CoCreateGuid
CoUninitialize
OleSetContainedObject
user32
ScreenToClient
SetTimer
GetCursorPos
GetMessageA
GetWindowLongA
DefWindowProcA
CreateWindowExA
UnhookWindowsHookEx
ClientToScreen
SetWindowLongA
FindWindowA
GetParent
GetWindowThreadProcessId
TranslateMessage
DispatchMessageA
DestroyWindow
RegisterWindowMessageA
KillTimer
GetWindow
GetSystemMetrics
GetClassNameA
SendMessageA
SetWindowsHookExA
PeekMessageA
PostQuitMessage
oleaut32
SysAllocString
SysFreeString
SysStringLen
SysAllocStringLen
shlwapi
StrStrIW
UrlUnescapeW
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegSetValueExA
DuplicateTokenEx
OpenProcessToken
RegDeleteValueA
RegOpenKeyExA
GetUserNameA
SetTokenInformation
RegQueryValueExA
shell32
SHGetFolderPathA
Exports
Exports
Sections
.text Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ