AgeremapHelper
Static task
static1
Behavioral task
behavioral1
Sample
8b53508362e6407cf596c4fe1b5fad20_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8b53508362e6407cf596c4fe1b5fad20_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8b53508362e6407cf596c4fe1b5fad20_JaffaCakes118
-
Size
152KB
-
MD5
8b53508362e6407cf596c4fe1b5fad20
-
SHA1
3ea0e518657e65ac5b46ae257dda0be33d67ca59
-
SHA256
cb39b2a03de5cbb53999b40d4952e8f325593088704abad88a4ac6a044fc968f
-
SHA512
337070b85563756aa48c3507af3f3b09cf87a568326a257a0b3e87c63549eccccc83ed4d5c5ae08563d984e711a179a84fd9136cc32cf314a89db25f5fecf7b4
-
SSDEEP
3072:eWLqgMCz32vatiyCTP9pFWxuxRz7vF9e//gJa4D73zPMnzBz3QGElFp:eWLqXCtPCTPRAonvFY3Ul3zPMtDIlF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8b53508362e6407cf596c4fe1b5fad20_JaffaCakes118
Files
-
8b53508362e6407cf596c4fe1b5fad20_JaffaCakes118.dll windows:4 windows x86 arch:x86
bd68ad2870619efa7a6e071e90d206d9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExitProcess
CloseHandle
GetModuleFileNameA
WriteFile
GetComputerNameA
HeapFree
UnmapViewOfFile
LoadLibraryA
GetCurrentProcess
CreateFileMappingA
GetVolumeInformationA
GetProcessHeap
GlobalAlloc
OpenEventA
EnterCriticalSection
CreateDirectoryA
GetTickCount
InterlockedCompareExchange
OpenFileMappingA
MapViewOfFile
GetModuleHandleA
CreateFileA
GetCommandLineA
LocalFree
InterlockedIncrement
TerminateProcess
GlobalFree
LeaveCriticalSection
CreateEventA
CopyFileA
GetLastError
WriteProcessMemory
CreateMutexW
CreateProcessA
WaitForSingleObject
Sleep
ReadProcessMemory
InterlockedDecrement
SetLastError
HeapAlloc
GetProcAddress
ole32
CoCreateInstance
OleSetContainedObject
CoSetProxyBlanket
CoTaskMemAlloc
CoInitialize
CoCreateGuid
CoUninitialize
OleCreate
user32
GetWindowThreadProcessId
PeekMessageA
ScreenToClient
PostQuitMessage
CreateWindowExA
RegisterWindowMessageA
GetCursorPos
GetClassNameA
KillTimer
GetWindowLongA
UnhookWindowsHookEx
SendMessageA
GetMessageA
GetSystemMetrics
TranslateMessage
DestroyWindow
GetWindow
SetTimer
FindWindowA
GetParent
SetWindowsHookExA
DispatchMessageA
ClientToScreen
SetWindowLongA
DefWindowProcA
oleaut32
SysFreeString
SysStringLen
SysAllocString
SysAllocStringLen
shlwapi
StrStrIW
UrlUnescapeW
advapi32
RegDeleteKeyA
SetTokenInformation
RegQueryValueExA
GetUserNameA
DuplicateTokenEx
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegOpenKeyExA
OpenProcessToken
shell32
SHGetFolderPathA
Exports
Exports
Sections
.text Size: 124KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ