Static task
static1
Behavioral task
behavioral1
Sample
3260fc933eecbb5463b06b62c5586701_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3260fc933eecbb5463b06b62c5586701_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3260fc933eecbb5463b06b62c5586701_JaffaCakes118
-
Size
112KB
-
MD5
3260fc933eecbb5463b06b62c5586701
-
SHA1
fefd67ba1d30cca3f2957c95aa8fd7a18131920a
-
SHA256
22e3abe69638965ad07ed6241d5e657acd09c1886bb054d0c2fa22f10a8295f7
-
SHA512
290d989b78da69260fb46853ae7389ac2f213932fe39741a63f8ccd3897454d528df6e99e8adb8e49f53137b705e904c45ec94b6399ae129f7c4ce5a859f3f72
-
SSDEEP
3072:lQHpYD7OHq5210dW2A0F6NVJYIcTXjVkDtJh0:iJu7GyW2A06JPkXjsJh0
Malware Config
Signatures
Files
-
3260fc933eecbb5463b06b62c5586701_JaffaCakes118.dll windows:4 windows x86 arch:x86
34a392d525587513c86d88be903bfac0
Code Sign
70:0a:7b:5e:6c:22:a4:f3:b7:24:46:06:7a:e0:d9:a1:96:77:f2:35Signer
Actual PE Digest70:0a:7b:5e:6c:22:a4:f3:b7:24:46:06:7a:e0:d9:a1:96:77:f2:35Digest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
msvcrt
_wcsnicmp
user32
OpenWindowStationW
MessageBoxA
winmm
waveInOpen
ws2_32
WSACleanup
msvfw32
ICClose
msvcp60
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
Exports
Exports
BeginProc
EndProc
RunProc
ServiceMain
֨�����r��}� A�C�I%��[������"��1:�n|��Yb�����,ϳJT�6,���e�V�j��C�$r9���c�#�۾�,��p��f�?���Sډ>�D"�5�%������c^NW�����N��q��q�+ou��u:�����ʝ"�O]�v����l����L������Et�a7�8wH�ߕy�T��E럩z�&�0�2ե�g��)։�G����X�f��M�d����7L<��^��#m�� Ў����谵{ʸ~T'�-Ѣ��to `u�(����,*�W���m�a��y��>�(n�j�ܥ��T�HI�X{��xu2m����{ �Y���V��Á ���(|�)��`щ��cR�.�9����9bj[T��j����t�&JX�Ư�����}�W�����H�ke ����V �m��G��7؛��Ux�,_#�|DX��K� � ���!N�4cR�� ��M��I��J�ɵw�01F�6���� D�R����1_][{{�[���x�6wV�!YF�M��h�Q��y(e}}�6���?!>ODa����q1�]O�%�k�-ZJ��I�*��Yf����˧��S��/����t���`����z�W,���1�}y�}d���J(t�_�&<�c5R9����>��)�")�.J�����g�D_��O���Nd���3���� �-�9�|E�@�^�ہʝ�����C������pʗi��x~�d���g��ct1i����~]Oȟ� ��Ffū���@�����{-X��� ��$��k���S(#� a���d���&���l�D�����3@D���(���\9ﱏ�p�����dt��Z>������K2b}��86�7FIwqg0hf�D�y���=Kȋ�f����I%��i�� ���q��X7Y�^���0�����mVC�Er��+i��Wt��Ht�g���oZ��(9srqvEc�`j1��F�*opMVX<K&��y��� ��n�`���A^S�54��x2�!r���Vx�b˧�!��Cs_�AY�8�\�.��A�gl�H�����L�]�Rl0S��:����D��9j�G�FSQ˨����x��U�D���3E����k��a�����3�=Ƀ4!��!��<�����p��Ւ %Kj�g�����d�@���>�K���~Sl_)D���.r�Z�����z&e�h��]%g�:u$G2�t5ƻ!+;�1�!5�������&'|�r� ���%��td�F"�1o�Z��bR^�a���[�����i"E �a�fִ2@)��8К�Nq�I����E6r��ĕw���l�S���H�8}���Ѡ�ӑtj`�Cs�+,�a������a�Yb���,v �+��)a���կHЀѣ�O\�x�$���T!��d��6���tݒ����N!^���E>\��ۤbǖ�Ht�����ơ�a,�wΊvs��p��訿�8�m`>�Cr���X0��t'�gӴ������/:�e��� �kҀ�����#vb5_�������{c��(;ˮ@`���Q9���U�!�n gPz`W�i�� ��@�=1]�. � ��N����do���i(�e��Ղ�y��۞��Zh*.��2-�0)m6/��A��g�N2�u�D$�6�U0`���������\V���6C�n�}�ҭ�h��J j�z�J;�g�9��/�6������eC����B� V���^1 �n��A�^��'}��i�a�I@�5/�%�����- �1#:7�%IcΖ��̗�9�UcZMu���c��呥�2�� �#g�6�a�4!��O��6�( -Z��v���c�����=��!R��l����� Cᡇ�`*��{� ^[?�"L#���\)��cԔ�a��v���-{֫������ؤsƕ�� ����Qlޱ�2�58� q[������(��43H��Vtz��2I�',%����&�$��ti�C�H��� {p�����~\>=x����O�k-"�]�����G����g#�`��eI6t I�`ԏ�0��2o��dʘBٺ�Ćڪ���ޠ�6�@�V��)?7�ɰqV}*@ ]���m�w�������`@f��y�&� ���e#%�-��0q�ȅ��a5DY�t,��7U�h+��1�q���V,�D����u��e|�~m{��h6SK� ꯨ�r��"�lko_����W>1v;�����[�g�Ђ�AAu�V���p�N��Go3!#�|��� ���x�A��� W眏��N*q��YV�ːMp-Uպ���$͆= ��-���E͢�������j����aב�Sϖי�gX�ˈb����ٲÕ;�1�.:&��d;7yѮP��j��͖�EJ�`�q�蛲 䄻$�R�M��Eȴ�3|ch�N߉����7����ܟ=���nԫUf˳�+�m뢗)����(�c��5�Y�$�[�v��H��iR=��L1`f����x�oK�˯Uy���|!��F��z/���8d�R_0�F���y{��/��� ���@eH��� ����cz���h%-�l�C��{��3�ǝ:� K�%��>�R8�@���E��(�/�Ցl�4�(�I.��L�O8%��n/%��Q�a���5*U���E�v@&(WOvNmd�ct�����Tl�?�����Ԑ�Nm[a�cQǗ���*�m�h��z���uũw�)]k�,6�%���ț_��b��şU�nW}}b��ۤ=�6d^3� �B�g۸<LG|r=&떽�&�lo�$�L�0[�G����j�ϸ��I��>i4��3�����?iO|��Ԉ��E:�ɳS�pu\2������8HDS$� �����3f<���|l)'mM����a��P�c��V~����C�I�����L�&/{��G��Q�>/�~�3��Ц������b)�����Ƀ��ߴ�O'�gԾLΆAZO��%��}p1�[Wzkd����I�#o{��jx}�Y���x|��K�Ц���ʸ �uTES,G���e�,l��]��T�+,���R������ݑp�jr��*f
Sections
it>..M*o Size: - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
R!#(sV@* Size: 47KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
@Q_/G/Aj Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
+_)rhCRV Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
H6a]TQtG Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
"F& Qo&u Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Pub1`sN# Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
eQ7 %l?v Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ