qoobrm
Static task
static1
Behavioral task
behavioral1
Sample
34aebbed4b5da5d91b389967c9b22442_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
34aebbed4b5da5d91b389967c9b22442_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
34aebbed4b5da5d91b389967c9b22442_JaffaCakes118
-
Size
248KB
-
MD5
34aebbed4b5da5d91b389967c9b22442
-
SHA1
73e025563842ddb5bd1d0c05b5d026c5829dc5dc
-
SHA256
2aa1035b546efb71c8238662ba4a1f29110cac9149abe40aef2eea8c6779750e
-
SHA512
bab20d904cec1f98782b4852470046d888bc84d714cf2979a377f233737a03ddcffda66e7cd158f7da3c0d759327340cddfd70fb702e85a1618269ba6aa9b159
-
SSDEEP
3072:l/Szpv5KnzaX07teZ9lUv1OnedfS4PjNQ/WQLIAInNkQgUDOD:WM8xW1HJPJQuM9T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 34aebbed4b5da5d91b389967c9b22442_JaffaCakes118
Files
-
34aebbed4b5da5d91b389967c9b22442_JaffaCakes118.dll windows:4 windows x86 arch:x86
d988502ff140b937ef14ec38a72a55d6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
ElfOpenBackupEventLogA
GetNamedSecurityInfoExA
RegisterTraceGuidsA
RegCloseKey
RegCreateKeyW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
gdi32
EnumMetaFile
GetPolyFillMode
BitBlt
CreateCompatibleDC
DeleteDC
SelectObject
SetBkMode
StretchBlt
kernel32
LoadResource
FindResourceA
GetCommandLineW
BuildCommDCBAndTimeoutsW
GetVolumePathNameW
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
LeaveCriticalSection
SetConsoleCursorInfo
Sleep
WaitCommEvent
lstrlenW
CloseHandle
CreateProcessA
FormatMessageW
FreeLibrary
GetCurrentProcess
GetFileAttributesW
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetVersionExW
GlobalAlloc
GlobalFree
LoadLibraryW
LocalAlloc
LocalFree
SetLastError
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
lstrcmpW
lstrcmpiW
lstrcpyW
lstrcpynW
VirtualAlloc
CopyFileA
CreateFileA
EnterCriticalSection
ReadFile
SetEndOfFile
SetEvent
SetFilePointer
WaitForSingleObject
CompareStringW
CompareStringA
GetLocaleInfoW
GetSystemInfo
VirtualProtect
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
SetEnvironmentVariableA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
HeapSize
LoadLibraryA
VirtualQuery
RtlUnwind
IsBadWritePtr
HeapReAlloc
GetCPInfo
GetOEMCP
GetACP
FatalAppExitA
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
GetCurrentThreadId
GetCommandLineA
GetVersionExA
ExitProcess
GetModuleHandleA
TlsAlloc
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
HeapFree
HeapAlloc
SetHandleCount
ole32
CoCreateInstanceEx
CoUninitialize
oleaut32
VarCyRound
VarR4FromUI1
rpcrt4
NdrEncapsulatedUnionMarshall
user32
SetForegroundWindow
SetFocus
SetDlgItemTextW
SetCursor
SendMessageW
SendDlgItemMessageW
PostMessageW
PeekMessageW
MessageBoxW
LoadStringW
LoadCursorW
IsWindow
IsDlgButtonChecked
GetSysColorBrush
GetParent
GetDlgItemTextW
SetWindowLongW
GetClientRect
FindWindowW
FillRect
EnableWindow
DispatchMessageW
DestroyWindow
DefWindowProcW
CheckDlgButton
CharPrevW
CharNextW
BringWindowToTop
ToAscii
SystemParametersInfoA
MessageBeep
GetLastInputInfo
GetKeyboardState
wsprintfW
ShowWindow
SendMessageCallbackA
GetDlgItem
DialogBoxParamW
Exports
Exports
Sections
.text Size: 188KB - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ