wtrMain
Static task
static1
Behavioral task
behavioral1
Sample
333d40bdd7b7b7e782cfc2086e97cb52_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
333d40bdd7b7b7e782cfc2086e97cb52_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
333d40bdd7b7b7e782cfc2086e97cb52_JaffaCakes118
-
Size
264KB
-
MD5
333d40bdd7b7b7e782cfc2086e97cb52
-
SHA1
8f82106b7d999d07ba78f3508da3458622b2c5d8
-
SHA256
0746dbcf959f10cb5bee2359d84d1c503d5e36aa9567bc75bd90dd0456ebff4a
-
SHA512
e9c01965ff9c98f98147362759f73500b43868549921ba87d6cf9641752665a55293f5939c51af13f52a959b2ab3e0cc672bbd0220a36d757da3a23a3ce06588
-
SSDEEP
6144:4iaw9EQsy6flUzHnISRs6T8wuERIDq1N3RTLkZJ:4iawCQsy6fiDF4kIDqjZsJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 333d40bdd7b7b7e782cfc2086e97cb52_JaffaCakes118
Files
-
333d40bdd7b7b7e782cfc2086e97cb52_JaffaCakes118.dll windows:4 windows x86 arch:x86
0e2a4c17bc27c10e113cb055dd98eea4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
dzss
?IsValueNA@DFormulaCell@@QBE_NXZ
?GetChars@DTwip@@QBENXZ
?GetColWidth@DDefaults@@QBEPBVDTwip@@XZ
?GetDefaults@DWorkbook@@QAEPAVDDefaults@@XZ
?MaxCol@DWorkbook@@QAEJXZ
?GetCount@DSSList@@QBEJXZ
?GetMaxCol@DWorksheet@@QAEJXZ
?GetWorksheet@DWorksheetList@@QAEPAVDWorksheet@@J@Z
?GetRow@DCoord@@QBEJXZ
?GetCellLocation@DCell@@QAEPAVDCoord@@XZ
?GetString@DString@@QAEPBDPAVDCharMapPkg@@@Z
?GetProtection@DWorksheet@@QBEJXZ
?GetDefaults@DWorksheet@@QAEPAVDDefaults@@XZ
?GetNoteText@DNote@@QAE?AVDString@@XZ
?GetNote@DCell@@QBEPAVDNote@@XZ
?GetRowHeight@DDefaults@@QBEPBVDTwip@@XZ
?GetTwips@DTwip@@QBEJXZ
?GetColumn@DCoord@@QBEJXZ
?GetType@DCell@@QBEJXZ
?GetSheet@DCoord@@QBEJXZ
?GetStyle@DCell@@QBEJXZ
?GetLabel@DLabelCell@@QBE?AVDString@@XZ
?GetValue@DValueCell@@QBENXZ
?IsValueNA@DValueCell@@QBE_NXZ
?IsValueERR@DValueCell@@QBE_NXZ
?GetValue@DIntCell@@QBEJXZ
?GetFloatValue@DFormulaCell@@QAENXZ
?GetCellStyle@DDefaults@@QBEJXZ
?GetSize@DCellLine@@QBEPBVDTwip@@XZ
?GetStringValue@DFormulaCell@@QAE?AVDString@@XZ
?IsValueSTR@DFormulaCell@@QBE_NXZ
?Validate@DFormulaStream@@QAEJP6AJPAPAVDToken@@@Z@Z
?GetFormula@DFormulaCell@@QAEPAVDFormulaStream@@XZ
?GetString@DStringToken@@QBE?AVDString@@XZ
?GetRangeList@DWorkbook@@QAEPAVDRangeList@@XZ
?GetShortVal@DValueToken@@QBEFXZ
?GetFloatVal@DValueToken@@QBENXZ
?GetNumArgs@DFunctionToken@@QBEJXZ
?GetType@DToken@@QBEJXZ
?GetNextToken@DFormulaStream@@QAEPAVDToken@@XZ
?GetRange@DRangeList@@QAEPAVDRange@@J@Z
?GetDimension@DRange@@QAEPAVDSSDimension@@XZ
?GetName@DRange@@QBE?AVDString@@XZ
?IsRowRelative@DLocationCoord@@QBE_NXZ
?IsColumnRelative@DLocationCoord@@QBE_NXZ
?GetBottomBorder@DBorder@@QAEPAVDBorderLine@@XZ
?GetTopBorder@DBorder@@QAEPAVDBorderLine@@XZ
?GetRightBorder@DBorder@@QAEPAVDBorderLine@@XZ
?GetLeftBorder@DBorder@@QAEPAVDBorderLine@@XZ
?GetBorder@DStyle@@QBEJXZ
?GetFont@DTextAttr@@QAEJXZ
?GetRGB@DColor@@QAEKPAVDColorPalette@@@Z
?GetColor@DTextAttr@@QAEPAVDColor@@XZ
?GetSize@DTextAttr@@QBEPBVDTwip@@XZ
?GetTextAttr@DStyle@@QBEJXZ
?GetBGColor@DCellAttr@@QAEPAVDColor@@XZ
?IsValueERR@DFormulaCell@@QBE_NXZ
?GetMaxRow@DWorksheet@@QAEJXZ
?GetAlignment@DCellAttr@@QBEJPAVDRelationalDB@@@Z
?GetCellAttr@DStyle@@QBEJXZ
?GetPlaces@DNumFmt@@QBEJXZ
?GetNumFmt@DStyle@@QBEJXZ
?GetBorder@DBorderLine@@QBEJPAVDRelationalDB@@@Z
?GetCompression@DPrintData@@QBEJXZ
?GetHeadings@DPrintData@@QBEJXZ
?GetGrids@DPrintData@@QBEJXZ
?GetOrientation@DPrintData@@QBEJXZ
?GetHeight@DDimension@@QBEPBVDTwip@@XZ
?GetWidth@DDimension@@QBEPBVDTwip@@XZ
?GetPaperSize@DPrintData@@QAEPAVDDimension@@XZ
?GetBottom@DMargins@@QBEPBVDTwip@@XZ
?GetTop@DMargins@@QBEPBVDTwip@@XZ
?GetRight@DMargins@@QBEPBVDTwip@@XZ
?GetLeft@DMargins@@QBEPBVDTwip@@XZ
?GetMargins@DPrintData@@QAEPAVDMargins@@XZ
?HasComma@DNumFmt@@QBE_NXZ
?HasNegativeParens@DNumFmt@@QBE_NXZ
?HasNegativeColor@DNumFmt@@QBE_NXZ
?IsUnderline@DTextAttr@@QBE_NXZ
?IsStrikethrough@DTextAttr@@QBE_NXZ
?IsItalic@DTextAttr@@QBE_NXZ
?IsBold@DTextAttr@@QBE_NXZ
?GetPageBreak@DPageBreakList@@QAEJJ@Z
?GetActivePane@DSplitInfo@@QBEJXZ
?GetNumColFromLeft@DSplitInfo@@QBEJXZ
?GetNumRowsFromTop@DSplitInfo@@QBEJXZ
?GetTopLeftPaneCoord@DSplitInfo@@QBEPAVDCoord@@XZ
?GetMode@DSplitInfo@@QBEJXZ
?DumpData@DFunctionToken@@UAEXAAV?$basic_ofstream@DU?$char_traits@D@std@@@std@@JPAD@Z
?Clone@DFunctionToken@@UBEPAVDToken@@XZ
?Copy@DToken@@UAEJPBV1@@Z
?IsFunctionToken@DFunctionToken@@UBE_NXZ
?Negate@DFunctionToken@@UBEPAVDToken@@XZ
?AdjustThis@DFunctionToken@@UBEPAVDToken@@N@Z
?Validate@DFunctionToken@@UAEJXZ
?DumpData@DValueToken@@UAEXAAV?$basic_ofstream@DU?$char_traits@D@std@@@std@@JPAD@Z
?Clone@DValueToken@@UBEPAVDToken@@XZ
?Copy@DValueToken@@UAEJPBVDToken@@@Z
?IsFunctionToken@DToken@@UBE_NXZ
?Negate@DValueToken@@UBEPAVDToken@@XZ
?AdjustThis@DValueToken@@UBEPAVDToken@@N@Z
?Validate@DToken@@UAEJXZ
?SetType@DToken@@QAEJJ@Z
??0DFunctionToken@@QAE@XZ
?SetFloatVal@DValueToken@@QAEJN@Z
?SwapArgs@DFunctionToken@@QAEJJJ@Z
?SetArg@DFunctionToken@@QAEJJPBVDToken@@@Z
?SetShortVal@DValueToken@@QAEJF@Z
??0DValueToken@@QAE@XZ
?DeleteArg@DFunctionToken@@QAEJJ@Z
?GetArg@DFunctionToken@@QAEPAVDToken@@J@Z
?SetNumArgs@DFunctionToken@@QAEJJ@Z
??1DValueToken@@UAE@XZ
??1DFunctionToken@@UAE@XZ
?GetGrids@DViewInfo@@QBEJXZ
?GetFirst@DSSList@@QAEPAXXZ
?GetPrintData@DWorkbook@@QAEPAVDPrintData@@XZ
?GetName@DWorksheet@@QAEPAVDString@@XZ
?GetPrintData@DWorksheet@@QAEPAVDPrintData@@XZ
?GetViewInfo@DWorksheet@@QAEPAVDViewInfo@@XZ
?GetRowPageBreakList@DPrintData@@QAEPAVDPageBreakList@@XZ
?GetColumnPageBreakList@DPrintData@@QAEPAVDPageBreakList@@XZ
?Next@DSSList@@QAEPAXXZ
?GetViewInfo@DWorkbook@@QAEPAVDViewInfo@@XZ
?GetSplitInfo@DViewInfo@@QAEPAVDSplitInfo@@XZ
?SetType@DString@@QAEJPAVDCharMapPkg@@@Z
?GetName@DFont@@QAE?AVDString@@PAVDRelationalFontDB@@@Z
??4DString@@QAEAAV0@ABV0@@Z
?AddWriterSupportedNumFmt@DNumFmtMapper@@QAEJV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@J@Z
?GetNumberOfChars@DString@@QAEJXZ
?GetString@DString@@QBEPBDXZ
?MapNumberFormatID@DNumFmtMapper@@QAEJABVDNumFmt@@@Z
?GetCount@DFormatList@@QAEJXZ
?GetFormatByIndex@DFormatList@@QAEPAVDFormat@@J@Z
?GetUnderlineRLDB@DWorkbook@@QAEPAVDRelationalDB@@XZ
??0DString@@QAE@XZ
?GetBorderLineRLDB@DWorkbook@@QAEPAVDRelationalDB@@XZ
?GetFontRLDB@DWorkbook@@QAEPAVDRelationalFontDB@@XZ
?GetAlignmentRLDB@DWorkbook@@QAEPAVDRelationalDB@@XZ
?GetNumFmtMapper@DWorkbook@@QAEPAVDNumFmtMapper@@XZ
?WriterSupported@DRelationalDB@@QAEJJ@Z
?GetColorPalette@DWorkbook@@QAEPAVDColorPalette@@XZ
?ClearSupported@DRelationalDB@@QAEJXZ
?SetAllSupported@DRelationalDB@@QAEJXZ
?SetWriterPaletteSize@DColorPalette@@QAEJK@Z
?SetColorInWriterPalette@DColorPalette@@QAEJKJ@Z
?SetDefault@DRelationalDB@@QAEJJ@Z
??4DString@@QAEAAV0@PBD@Z
?GetFontID@DRelationalFontDB@@QBEJABVDString@@@Z
?FillWorkbookPrintViewDefaults@DWorkbook@@QAEJXZ
??1DString@@QAE@XZ
?SetDstType@DCharMapPkg@@QAEJJ@Z
?GetBorderList@DStyleMgr@@QAEPAVDFormatList@@XZ
?GetWorksheetList@DWorkbook@@QAEPAVDWorksheetList@@XZ
?GetStyleMgr@DWorkbook@@QAEPAVDStyleMgr@@XZ
?GetTextAttrList@DStyleMgr@@QAEPAVDFormatList@@XZ
?GetNumFmtList@DStyleMgr@@QAEPAVDFormatList@@XZ
?GetFontList@DStyleMgr@@QAEPAVDFormatList@@XZ
??1DCharMapPkg@@QAE@XZ
?GetCellAttrList@DStyleMgr@@QAEPAVDFormatList@@XZ
?GetStyleList@DStyleMgr@@QAEPAVDFormatList@@XZ
?GetLock@DCellAttr@@QBEJXZ
??0DCharMapPkg@@QAE@XZ
?IsWrap@DCellAttr@@QBE_NXZ
kernel32
LoadLibraryA
GetOEMCP
GetCPInfo
GetStringTypeW
GetACP
IsBadCodePtr
IsBadReadPtr
GetStringTypeA
VirtualAlloc
WriteFile
IsBadWritePtr
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoA
FreeEnvironmentStringsA
GetStdHandle
SetHandleCount
GetFileType
HeapCreate
HeapDestroy
VirtualFree
GetProcAddress
LCMapStringW
GetModuleHandleA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
HeapFree
HeapSize
SetUnhandledExceptionFilter
TerminateProcess
ExitProcess
GetCurrentProcess
HeapReAlloc
GetVersion
HeapAlloc
RtlUnwind
RaiseException
GetCommandLineA
GlobalFree
GlobalAlloc
GlobalReAlloc
GlobalLock
GlobalUnlock
Exports
Exports
Sections
.text Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 180KB - Virtual size: 187KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ