Static task
static1
Behavioral task
behavioral1
Sample
4be737e96041b06ad4e7fcd28f277cce_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4be737e96041b06ad4e7fcd28f277cce_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4be737e96041b06ad4e7fcd28f277cce_JaffaCakes118
-
Size
353KB
-
MD5
4be737e96041b06ad4e7fcd28f277cce
-
SHA1
703f8fc24b5101fb625ff21b258fe9d187e23709
-
SHA256
5bfe1d77e4ab278f22f0e8e3f55fe2091a3b77ab254448523ed3c8b8132ab8fd
-
SHA512
71da28a78f99b40bff275526a33260048b26b46b4ba07c4fa196d7c5864d0ddc741dda94e5f0f0acbefda2e79beae7722404c2aff30cdb9e85fc2dfda193125f
-
SSDEEP
6144:wZUEsV3iWw6l/UFfbpAzhGyYXsq1ocX7Ez0xkA7GGwVeFtV1+q1SeTql8sNpJ:UediWw6NUT+hGyxMLEYDGFGT+teTqlJJ
Malware Config
Signatures
Files
-
4be737e96041b06ad4e7fcd28f277cce_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
9de537846937d5d2c86e76f7745965bb
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01/08/1996, 00:00Not After31/12/2020, 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06/08/2003, 00:00Not After05/08/2013, 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
6e:c7:7a:80:ba:a8:19:8f:9b:da:85:0b:6f:39:25:0fCertificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before01/09/2006, 07:44Not After31/08/2008, 07:44SubjectCN=Neosystems.,OU=resarch and develop,O=Neosystems.,L=Guro-gu,ST=Seoul,C=KRExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
user32
GetKeyboardType
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
IsEqualGUID
comctl32
ImageList_SetIconSize
shell32
ShellExecuteExA
imm32
ImmSetConversionStatus
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
CODE Size: 338KB - Virtual size: 1008KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE