Static task
static1
Behavioral task
behavioral1
Sample
c88e8e02c0e285830d6c3c5da0c5dbd3_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c88e8e02c0e285830d6c3c5da0c5dbd3_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c88e8e02c0e285830d6c3c5da0c5dbd3_JaffaCakes118
-
Size
604KB
-
MD5
c88e8e02c0e285830d6c3c5da0c5dbd3
-
SHA1
0410b5eaada1d9499df876b900b3148e14a45cad
-
SHA256
06cca6f1e5a61d0802cc40e81fe838de218255990a6771da2023ae6a6918ba8f
-
SHA512
8c21e197a8e067ccc65bbfb60437fb33756cf4c2688dcf93d4c7085afb0a2cc059d106e5797b579021c6417d38b6231a00475db35db17ab41c44861ff402ed19
-
SSDEEP
3072:fw3gseqJzibVh9idYxgk8pHO+yF7hZaiUSt5l7nw:yJzXdWgt8XZqS5l8
Malware Config
Signatures
Files
-
c88e8e02c0e285830d6c3c5da0c5dbd3_JaffaCakes118.dll windows:5 windows x86 arch:x86
1c97eeddb714ef5be9be48b714f0d85b
Code Sign
01Certificate
IssuerCN=Toqa Lionb,O=Ypicup Yiwekmabi Po,L=Gitjinge,ST=Rogfe,C=GBNot Before21/07/2015, 10:33Not After20/07/2016, 10:33SubjectCN=Eys Nijpi,O=Ypicup Yiwekmabi Po,L=Gitjinge,ST=Rogfe,C=GBac:0b:6b:c5:f3:66:88:d0:88:98:8a:35:a6:40:f7:d6:d5:4f:7e:50Signer
Actual PE Digestac:0b:6b:c5:f3:66:88:d0:88:98:8a:35:a6:40:f7:d6:d5:4f:7e:50Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersionExW
LoadLibraryW
GetProcAddress
GetLastError
CreateFileW
GetFileSize
SetFilePointer
WriteFile
ReadFile
CloseHandle
FreeLibrary
InterlockedCompareExchange
InterlockedExchange
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
OutputDebugStringW
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
GetSystemTimeAsFileTime
HeapFree
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
HeapAlloc
InitializeCriticalSectionAndSpinCount
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsDebuggerPresent
ExitProcess
GetModuleHandleExW
HeapSize
GetStdHandle
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetProcessHeap
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
GetTimeZoneInformation
LoadLibraryExW
SetEnvironmentVariableA
user32
RegisterWindowMessageW
shell32
SHGetFolderPathW
ord165
ole32
CoTaskMemFree
Exports
Exports
GetSwitchUPAndSetItDown
GetToasterUPAndSetItDown
LockDisable
LockSleep
SetASParam
SetDomains
SetKSParam
SetLSParam
SetMainWnd
SetRedirect
SetSavedDomains
SetkillForeverParamName
SetstartRdrParamName
UnlockDisable
UnlockSleep
WSARecvHookedRedir
WSASendHookedRedir
recvChrHookedRedir
recvFFHookedRedir
sendFFHookedRedir
Sections
.text Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.QCHSIDE Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.HKT Size: 389KB - Virtual size: 389KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 936B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ