Static task
static1
Behavioral task
behavioral1
Sample
c25481f3de036e2c40d944ef6a77df33_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
c25481f3de036e2c40d944ef6a77df33_JaffaCakes118
-
Size
59KB
-
MD5
c25481f3de036e2c40d944ef6a77df33
-
SHA1
7a115e221fa0e21b411a40c126a1da91bdc100b5
-
SHA256
dc2d1bfef59de369669d4b97c2cc46478e359df5ad453bbace003e01fa558306
-
SHA512
2303994331403b4de8fcbd2f56c510b17f5d2baf6218dcba85cbccbc4d796f147d20aa2d02af9f76393c5276232b5b93e6d03b81c3829e2cf22400b3d8f62505
-
SSDEEP
768:9zSV6P1ea7NG3afySvZlLJyaey+KThU9VP2hvHpQHw9QNRUiTi06EwIbrLl:wV6PVhxfyyKCF6w9QbOnEwirx
Malware Config
Signatures
Files
-
c25481f3de036e2c40d944ef6a77df33_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
50e938f9ce22c539216fef09300f63a5
Code Sign
3a:aa:24:d3:a7:9a:11:59:bd:5f:49:42:5d:b9:47:f4Certificate
IssuerCN=Root AgencyNot Before22/06/2009, 06:42Not After31/12/2039, 23:59SubjectCN=Microsoft(R) Windows Media Player,O=Microsoft(R) Windows Media Player38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcatA
GetCurrentThreadId
InitializeCriticalSection
FreeLibrary
GetProcAddress
HeapDestroy
DeleteCriticalSection
lstrcpyA
InterlockedIncrement
FlushInstructionCache
GetCurrentProcess
OpenProcess
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DisableThreadLibraryCalls
LoadLibraryA
CreateThread
TerminateThread
CloseHandle
GetModuleHandleA
GetShortPathNameA
MultiByteToWideChar
lstrlenW
GetVersionExA
GetModuleFileNameA
lstrlenA
InterlockedDecrement
user32
PostMessageA
wsprintfA
CharNextA
DestroyWindow
LoadStringA
CreateWindowExA
CallWindowProcA
GetWindowLongA
SetWindowLongA
DefWindowProcA
GetClientRect
EndPaint
GetDC
ReleaseDC
GetFocus
IsChild
GetClassInfoExA
LoadCursorA
RegisterClassExA
BeginPaint
gdi32
LPtoDP
SaveDC
CreateDCA
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
GetDeviceCaps
RestoreDC
advapi32
RegCreateKeyExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegSetValueExA
ole32
CoInitialize
CoCreateInstance
CoGetMalloc
StringFromIID
OleInitialize
oleaut32
SysStringLen
LoadRegTypeLi
DispCallFunc
SysAllocString
LoadTypeLi
RegisterTypeLi
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
VariantCopy
VariantClear
SafeArrayGetDim
SafeArrayGetElemsize
SysFreeString
SafeArrayGetUBound
msvcrt
malloc
_adjust_fdiv
_initterm
_onexit
__dllonexit
strtol
wctomb
_mbsnbcmp
_mbschr
_mbclen
_mbsnbicmp
sprintf
_strcmpi
wcslen
_mbsstr
free
_purecall
realloc
memcmp
_mbsicmp
time
srand
rand
atoi
strcpy
_mbsrchr
_except_handler3
strlen
__CxxFrameHandler
??3@YAXPAX@Z
memcpy
memset
??2@YAPAXI@Z
memmove
shlwapi
PathFindFileNameA
wininet
InternetGetConnectedState
msvcp60
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
psapi
GetModuleBaseNameA
EnumProcessModules
EnumProcesses
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ