userNetdrm
Static task
static1
Behavioral task
behavioral1
Sample
5b85424306e1db0f626f353bb3c4f535_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5b85424306e1db0f626f353bb3c4f535_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5b85424306e1db0f626f353bb3c4f535_JaffaCakes118
-
Size
140KB
-
MD5
5b85424306e1db0f626f353bb3c4f535
-
SHA1
5e36c5b356ffd312ba9fb9394e6215404c939aa0
-
SHA256
cc420237c2bc0770f3079b41cd03cce17cc9a171edb117b50640fcb6b6305d93
-
SHA512
187393fda554d4b497e3a8b0bd0ae47c595b1bc8cd956a9c575caec5abca84f5fe8b45362c25f344beee8dd66fa288f957fefee24f69e5a7af202bb1c0ec6eb7
-
SSDEEP
3072:nNk8OFxFKfxe+SyC2mb4g7llyHuGcKav9R9POMNnP9U0g:Nk8SfKfY1yihJAJcKav9nf+0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b85424306e1db0f626f353bb3c4f535_JaffaCakes118
Files
-
5b85424306e1db0f626f353bb3c4f535_JaffaCakes118.dll windows:4 windows x86 arch:x86
9cf41fc99c83a897d0bf41e4bf41bea8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
OpenEventA
WriteProcessMemory
InterlockedCompareExchange
GetLastError
Sleep
GlobalFree
LocalFree
GetVolumeInformationA
GetCurrentProcess
InterlockedDecrement
LeaveCriticalSection
HeapFree
CreateDirectoryA
ExitProcess
WaitForSingleObject
GetProcAddress
WriteFile
EnterCriticalSection
GetComputerNameA
HeapAlloc
TerminateProcess
CloseHandle
GetCommandLineA
CreateProcessA
GlobalAlloc
CreateFileA
LoadLibraryA
GetModuleHandleA
CreateFileMappingA
SetLastError
OpenFileMappingA
CreateMutexW
ReadProcessMemory
CreateEventA
UnmapViewOfFile
InterlockedIncrement
GetModuleFileNameA
CopyFileA
GetTickCount
GetProcessHeap
MapViewOfFile
ole32
CoCreateInstance
CoCreateGuid
CoTaskMemAlloc
CoInitialize
CoSetProxyBlanket
OleSetContainedObject
OleCreate
CoUninitialize
user32
TranslateMessage
PeekMessageA
FindWindowA
SetWindowsHookExA
GetClassNameA
GetMessageA
DispatchMessageA
SetWindowLongA
RegisterWindowMessageA
GetWindowThreadProcessId
SetTimer
DestroyWindow
GetSystemMetrics
GetWindowLongA
PostQuitMessage
ScreenToClient
DefWindowProcA
SendMessageA
GetWindow
CreateWindowExA
GetParent
GetCursorPos
ClientToScreen
UnhookWindowsHookEx
KillTimer
oleaut32
SysAllocString
SysAllocStringLen
SysStringLen
SysFreeString
shlwapi
StrStrIW
UrlUnescapeW
advapi32
RegCloseKey
OpenProcessToken
DuplicateTokenEx
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
SetTokenInformation
GetUserNameA
shell32
SHGetFolderPathA
Exports
Exports
Sections
.text Size: 116KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ