c:\work\0047.BHO\bho\BHO_full_tbws\release\vmmreg32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
33abec7250407b0a93775305da1ef3bf_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
33abec7250407b0a93775305da1ef3bf_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
33abec7250407b0a93775305da1ef3bf_JaffaCakes118
-
Size
280KB
-
MD5
33abec7250407b0a93775305da1ef3bf
-
SHA1
b9875fb0214365805f503696ead6e73f7ee259f6
-
SHA256
2e8939ff5b81d1214820146fd65f5b231389a70d1a992f81f8ff8c9fce5024d4
-
SHA512
37747122db8fec817b10739341bf1baceba4cd66c1aaa2b63a4981b714f3b8c322d388e820501443b318e0ef6985d17cbfeb3d5a18f0e202bf7e81d48ec0d52f
-
SSDEEP
3072:qUct+p4yDYE/n8Qc0C2xAp2eqtJcJRfEOJq/9FsejXfQXKnLt3UzVWFxXbY2oDvs:bq+pGM8kkXqAnJ8zsyn+pc5oeRcYx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 33abec7250407b0a93775305da1ef3bf_JaffaCakes118
Files
-
33abec7250407b0a93775305da1ef3bf_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
bb8462a29560546ff928a7334abf6fd5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
winhttp
WinHttpSetDefaultProxyConfiguration
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
psapi
EnumProcessModules
EnumProcesses
GetModuleFileNameExW
kernel32
LockResource
LoadResource
FindResourceW
FindResourceExW
MultiByteToWideChar
GlobalFree
GetLastError
Sleep
GetWindowsDirectoryW
DeleteFileW
FreeLibrary
GetCurrentProcess
GetProcAddress
LoadLibraryW
OpenProcess
lstrlenA
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
lstrcmpiW
GetModuleFileNameW
FindClose
FindNextFileW
FindFirstFileW
CreateDirectoryW
WaitForMultipleObjects
FindFirstChangeNotificationW
CreateEventW
InterlockedIncrement
InterlockedDecrement
LoadLibraryExW
GetModuleHandleW
SetThreadLocale
GetThreadLocale
CreateThread
GetModuleHandleExW
SizeofResource
WaitForSingleObject
SetFilePointer
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileAttributesW
GetCurrentDirectoryW
SetFileTime
FileTimeToSystemTime
GetFileSize
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingW
GetLocalTime
UnmapViewOfFile
GetTickCount
InterlockedExchange
GetACP
GetLocaleInfoA
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetStringTypeW
GetStringTypeA
lstrlenW
WriteFile
WideCharToMultiByte
SetEnvironmentVariableA
CreateFileW
ReadFile
CloseHandle
GetExitCodeProcess
CreateProcessA
GetFileAttributesA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
CompareStringA
CompareStringW
DisableThreadLibraryCalls
LoadLibraryA
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
GetOEMCP
GetCPInfo
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapCreate
VirtualAlloc
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
VirtualFree
user32
CharNextW
wsprintfW
UnregisterClassA
GetDesktopWindow
advapi32
CloseServiceHandle
RegEnumKeyExW
GetUserNameW
RegEnumValueW
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegNotifyChangeKeyValue
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegSaveKeyW
CreateServiceW
OpenSCManagerW
OpenServiceW
StartServiceW
RegCreateKeyW
RegRestoreKeyW
RegCloseKey
ole32
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
oleaut32
VarUI4FromStr
SysFreeString
SysAllocString
LoadTypeLi
LoadRegTypeLi
DispCallFunc
VariantClear
VariantInit
RegisterTypeLi
SysStringLen
shlwapi
SHRegCreateUSKeyW
SHDeleteKeyW
SHRegSetUSValueW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllRunThreads
DllUnregisterServer
Sections
.text Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ