Static task
static1
Behavioral task
behavioral1
Sample
971c0ab0c8a4b1dc44777e6b90260524_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
971c0ab0c8a4b1dc44777e6b90260524_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
971c0ab0c8a4b1dc44777e6b90260524_JaffaCakes118
-
Size
44KB
-
MD5
971c0ab0c8a4b1dc44777e6b90260524
-
SHA1
c80c1cf9442238e07ac072890beb9cdb2d8e90f9
-
SHA256
07712e49b1506cc05f59bb8846d5e4dfed83dac90c7526bfa26a22c9aaa755a3
-
SHA512
ac4a02aac81395df09f3d6d1a3b284f0cb7e9fe2c812336a23552fee774ff553d76130de3787517a95b7279d9b901019a7a1e6395d2f39242ed702a4968bdfaa
-
SSDEEP
768:m3iPyRkHmZi/dzzBGxm8rnCf9PlJ/lO0Z2E3UX6E:ex8GYCc9PlJ/lpfUXp
Malware Config
Signatures
Files
-
971c0ab0c8a4b1dc44777e6b90260524_JaffaCakes118.dll windows:4 windows x86 arch:x86
caa2be070ca0512e15b7d84a8b8ccb8c
Code Sign
11:f3:af:c3:27:d0:1e:a0:4b:6d:03:1a:ce:d9:5c:a2Certificate
IssuerCN=Root AgencyNot Before08/12/2009, 07:34Not After31/12/2039, 23:59SubjectCN=Microsofft 模块Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpyA
lstrcatA
InterlockedIncrement
GetCurrentThreadId
InitializeCriticalSection
HeapDestroy
LoadLibraryA
InterlockedDecrement
FlushInstructionCache
GetCurrentProcess
DebugBreak
OutputDebugStringA
lstrlenW
GetProcAddress
FreeLibrary
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
MultiByteToWideChar
lstrlenA
DisableThreadLibraryCalls
DeleteCriticalSection
Sleep
user32
wsprintfA
CharNextA
DestroyWindow
DefWindowProcA
RegisterClassExA
LoadCursorA
GetClassInfoExA
IsChild
GetFocus
ReleaseDC
GetDC
CharLowerA
CallWindowProcA
GetWindowLongA
CreateWindowExA
EndPaint
GetClientRect
BeginPaint
SetWindowLongA
wvsprintfA
PostMessageA
LoadStringA
advapi32
RegCloseKey
RegCreateKeyExA
RegSetValueExA
ole32
StringFromIID
CoGetMalloc
CoCreateInstance
oleaut32
RegisterTypeLi
LoadTypeLi
SysAllocString
DispCallFunc
LoadRegTypeLi
SysStringLen
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
VariantCopy
VariantClear
SafeArrayGetDim
SafeArrayGetElemsize
SysFreeString
gdi32
RestoreDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
CreateDCA
DeleteDC
msvcrt
memmove
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
atoi
_ismbcdigit
wcslen
_mbsicmp
_mbsstr
free
_purecall
memcmp
??2@YAPAXI@Z
memset
memcpy
__CxxFrameHandler
strlen
strcpy
fopen
strstr
strncpy
strftime
localtime
time
strchr
fclose
??3@YAXPAX@Z
Exports
Exports
BGRXbtsag_2
BetJHVdrIaoNjtL
CKIMXqUGr_b
DllCanUnloadNow
DllGetClassObject
DllSSS
DllUnregisterServer
EFOZKfmKJ_n
ELmsZfgrFkVhjRb
FJBHEmVHdFXWgYG
FOXiRoREs_8
GVbGInRTp_j
GZAabbfWZ_a
GsrlZiiZrllcdXZ
HRbPHXfWT_3
HrXlUKCRjWWtJkQ
IFYXmZOODNsTknY
IOsPSEIeLYiYhVh
IkqWSMZSYSXOPEC
JSBTJEZge_c
JSUiOWshk_7
JmNoVSelpUlpTOg
LLhqYDpRO_k
MjMVQiHpQ_d
NhorGEaaBZPOCSD
NiZFOYHNb_m
PEkhkFStp_h
QRBGpdXjtVpamhF
QtdjMAGjX_i
RHKKRLlbg_g
SbBbjiQOiRYihnP
TcjtmnVhjDlOVDc
VKWosjLqSKOsXAl
WIeRHRiOe_5
WKdOkNZceRmGEeo
WONfdHYtF_1
ZFKRlAFhGmQJDiM
ZVjXjsIkg_9
albjoGakHYAklcZ
bCngZrTJN_e
icrCgORgslIgZPK
irYDGrGbXgMlQDh
jtpVJDbfniqSFNA
noNMMTiSlINPFhe
npfBZgOZokPtVDt
oZCraUEFD_4
pKKDjjhtH_l
qTdtaPbLQnkfZaV
rFpfOJFGksmBZLj
rfLTcstQf_6
sFabQjdff_f
Sections
.text Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ