Static task
static1
Behavioral task
behavioral1
Sample
71d383c3075f901ff4414b645b2f8e9a_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
71d383c3075f901ff4414b645b2f8e9a_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
71d383c3075f901ff4414b645b2f8e9a_JaffaCakes118
-
Size
760KB
-
MD5
71d383c3075f901ff4414b645b2f8e9a
-
SHA1
6023baa1700b7d81eb886c18b5b4bcdde3844cc1
-
SHA256
cb1637d6c48699f856e1fc807548f40412ac8b89f1b30effa48ddbfc62b921fc
-
SHA512
583236701b5e5dc38464a8920df4a3fd4d5337d2333e93c31991bd9de262832d9448f9be3ca5b20f9ee207232bacf15bed6bd925be5349097932986b7979e974
-
SSDEEP
12288:xmIKbg6QIzsfWP6FuCIVk2hE5L3jgmb9VNvPZNEwzLW+zUsX:x7KsENSXIZO8UPl/EwpUc
Malware Config
Signatures
Files
-
71d383c3075f901ff4414b645b2f8e9a_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01/08/1996, 00:00Not After31/12/2020, 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d60:3e:32:d2:77:20:11:03:dc:e8:5c:7d:10:8b:bd:37Certificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before16/03/2010, 00:00Not After16/03/2011, 23:59SubjectCN=Vanilla Huis TEN.co\,.Ltd,OU=ec team,O=Vanilla Huis TEN.co\,.Ltd,L=Guro-gu,ST=Seoul,C=KRExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06/08/2003, 00:00Not After05/08/2013, 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
e6:3a:82:c9:2a:9c:c7:6a:ec:89:c4:a0:a3:5b:45:44:3c:e4:b5:ecSigner
Actual PE Digeste6:3a:82:c9:2a:9c:c7:6a:ec:89:c4:a0:a3:5b:45:44:3c:e4:b5:ecDigest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
CODE Size: 543KB - Virtual size: 542KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 163B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 154KB - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ