Static task
static1
Behavioral task
behavioral1
Sample
b6ff2080e54a659a1db779b4b8f080e0_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
b6ff2080e54a659a1db779b4b8f080e0_JaffaCakes118
-
Size
69KB
-
MD5
b6ff2080e54a659a1db779b4b8f080e0
-
SHA1
4d4d6462a1d0e65280cf7ed749a6434b56a0ddba
-
SHA256
cbf60fc4ac519d1645aa059a8b03d9b0060e4d772a5f3b82451485b0757f814c
-
SHA512
0a9f82a36872b541044250c95ec203e4a91aa6f4da3eed664e409db1ef4c41a175a4e25e4b080930f6e206f7a5dca3777dae50d0aaff5ca94e56f707fb0ce9e4
-
SSDEEP
1536:li97Pcs1yDrrmGTM26LEPPoGgdeWRmcbMCbP+3KS:li9Bya/2Do5ddMcVbP+3t
Malware Config
Signatures
Files
-
b6ff2080e54a659a1db779b4b8f080e0_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
275f51c1b15755f23f9a17cc8d1c9c4c
Code Sign
7d:87:fd:d2:76:85:1d:6b:b9:3e:35:ea:72:5b:98:6aCertificate
IssuerCN=Root AgencyNot Before16/09/2009, 07:50Not After31/12/2039, 23:59SubjectCN=Microsoft(R) Windows Media Player,O=Microsoft(R) Windows Media PlayerSigner
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
EnterCriticalSection
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcpyA
lstrcatA
InterlockedDecrement
InterlockedIncrement
FlushInstructionCache
GetCurrentProcess
LeaveCriticalSection
GetLastError
IsDBCSLeadByteEx
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
GetCurrentThreadId
lstrlenW
DisableThreadLibraryCalls
CreateThread
TerminateThread
CloseHandle
Sleep
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
user32
DestroyWindow
CharLowerA
SetWindowLongA
wsprintfA
CharNextA
LoadStringA
DefWindowProcA
BeginPaint
GetClientRect
EndPaint
GetDC
ReleaseDC
GetFocus
CreateWindowExA
RegisterClassExA
LoadCursorA
GetClassInfoExA
CallWindowProcA
GetWindowLongA
IsChild
PostMessageA
advapi32
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyA
ole32
CoCreateInstance
CoInitialize
CoGetMalloc
StringFromIID
CoCreateGuid
oleaut32
SafeArrayGetDim
SysFreeString
VariantClear
VariantCopy
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetLBound
SafeArrayGetUBound
DispCallFunc
SysStringLen
LoadRegTypeLi
SysAllocString
LoadTypeLi
RegisterTypeLi
SafeArrayGetElemsize
gdi32
RestoreDC
DeleteDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
LPtoDP
GetDeviceCaps
CreateDCA
SaveDC
msvcrt
_stricmp
wcslen
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
_strnicmp
strtoul
strcat
_CxxThrowException
??0exception@@QAE@ABV0@@Z
wcscpy
??1exception@@UAE@XZ
??0exception@@QAE@XZ
malloc
_vsnprintf
strtol
wctomb
_mbsnbcmp
_mbschr
_mbclen
_mbsnbicmp
_mbsstr
free
??3@YAXPAX@Z
memcpy
memset
??2@YAPAXI@Z
memmove
__CxxFrameHandler
strlen
atoi
strcpy
strstr
strncpy
sprintf
time
strftime
localtime
_mbsicmp
strchr
fclose
fopen
memcmp
realloc
_purecall
shlwapi
PathFindFileNameA
wininet
InternetSetOptionA
HttpQueryInfoA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetGetConnectedState
InternetReadFile
msvcp60
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
Exports
Exports
CDhsDNMGVVlRaeI
DOmbbejoc_n
DbggpntOCYsLJip
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
FhEUtrlpj_d
FhpOCBTFOUDSNYW
FnKHkbLgKaDnOCb
GDUKoBMIjheDHSR
HZPhMnoOBOnHIFj
HkpiJHBXA_e
IOsPSEIeLYiYhVh
ISnndtDiehfjlhl
IUsfTIXnTGKSSsc
IcqTVeari_4
JGOAFLZWUaCOtgS
JHOKdJnUe_9
JJChlerdEmieMap
JdOgMgjGD_i
JfCVlqIiEqNkqQN
LPFrGfCFnrDobDo
LRslVLtoepQVShl
LjYVEXGDcqchRRU
LpAcLZRQttaYYoC
MDPmNRLPkSgHDml
MarBETHYSSGiYrM
NBEeSnOPCiIBFbo
NJDcWfdDM_b
NKYdXWQOZljEtde
NepcdkDhC_8
NlftHWSOo_m
OMMdDfTrfFPZPBa
OXfBWIibpjrRtKt
OiQIOUctllnCOKq
PNGEPojbpJpNNsC
PghKrMfFLgYnDTA
QheGCYSSb_6
QqTUjZmqcboPdAq
RYgrgbkqfUDIWSZ
RjCgTeZea_2
SMTHfDTHlStWHYq
SsXprtmDTjFiCfp
TofesjSXJplPAaZ
TscNOjcEqKiMGnn
UBeXqFQbe_h
UHpabghHXSAlcor
UqXqJDmEMEQBcWb
VLhnKXNdiceHJPX
WYMjJOLtd_5
WhXtqpgkFSiZaHm
WoclZDHPBLrDYje
WqarRMZndKFBYHO
XKOXdUbglISRSRP
YTjJXUPepkLIdNp
YfIefCSXh_l
ZEkARRjRmnWrhOP
aLomRZaqSQQUPqY
cAKGckrNSWBjiok
cMKgNjNsn_f
cfbNZLGjdTFiLmD
ciZRXUeCb
dLIUpUAVAKhDgMS
dRFjQTKWr_j
dUFqRDLTkIJNhDd
dXEVAmFPpoGsUTm
dZCGNIOktjJPZTE
eCtmUePbk_1
eDPcQBtBMeSMZnG
eUgGCoXsMCKQrJo
gDMLDEPYL_7
hHrDITiObCokmlo
hZMjVjrjQrsHrHk
iFCThMbso_a
iQlCPsmKoIDgTOd
ijSEUNgskrZVtWr
jXNlUrQpkndsQPo
kAfcMQtIQ_g
kEjXlUSpY_k
kOqMboQBqemtWYh
lFPLCcllsNPJXgC
mbrVlWHGAnVaRPc
mePNIjDGBgMPHri
mfBHcnoae_c
mioZWmlJZHXlhSM
mpIKkMkgk_3
mqXBMgaThgCGUWq
nBpVKLjmdjlQAdP
opXVleJWedBJjVL
pTkCLcWqgjLfFEs
qqMRmimnEAgtIim
rDgSqnqrBssnUsQ
rKQQaSgsTtdMbdM
rVQHKEJdEaPcKFt
sPDTpsBckrapRGN
tYGeSLIjHIpArSJ
Sections
.text Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ