Static task
static1
Behavioral task
behavioral1
Sample
d48e3cb689e7172900a8fbdca8fe460a_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d48e3cb689e7172900a8fbdca8fe460a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d48e3cb689e7172900a8fbdca8fe460a_JaffaCakes118
-
Size
391KB
-
MD5
d48e3cb689e7172900a8fbdca8fe460a
-
SHA1
75f49a23842eb41661b15e303517c2e9c4945e39
-
SHA256
6f9097ab056e75af30df3ccb6e5e2969a0f50d16a513b66e29bd02fbce203df3
-
SHA512
08f211b1ee5aa6c0a017d03b52ab5e2571cd7bed1be426b67ad6f92aa627783f2122273736af80b0508f4c0ca815cf56b075fdd6eb5e58a2cca2c88b3c66e3de
-
SSDEEP
6144:C1R9Xlhd0wt2ix5vY1Ms8zdU7WDfG6HYb:eR1lhNMy5vY1MFzdU7WbYb
Malware Config
Signatures
Files
-
d48e3cb689e7172900a8fbdca8fe460a_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
b20d041fa1e3574be8dc111fb517b1b5
Code Sign
60:bd:5b:18:38:fe:fe:5d:ba:75:b1:57:2c:e6:10:13Certificate
IssuerCN=My CANot Before29/06/2012, 15:17Not After31/12/2039, 23:59SubjectCN=OpelSigner
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
wininet
InternetCloseHandle
InternetOpenA
InternetReadFile
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
kernel32
CloseHandle
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
InterlockedIncrement
InterlockedDecrement
FreeLibrary
lstrcmpiA
MultiByteToWideChar
IsDBCSLeadByte
lstrlenW
GetLastError
LoadLibraryExA
GetModuleHandleA
CreateThread
GetSystemTime
GetDateFormatA
Sleep
GetSystemDirectoryA
GetVersionExA
LockResource
GetFileAttributesA
LoadLibraryA
CreateFileA
SetFilePointer
GetProcAddress
ReadFile
WriteFile
GetTempPathA
GetTempFileNameA
WinExec
CreateMutexA
GetTimeFormatA
GetLocalTime
SetStdHandle
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
RaiseException
lstrlenA
GetTickCount
FindResourceExA
FindResourceA
CreateDirectoryA
LoadResource
SizeofResource
WideCharToMultiByte
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
ExpandEnvironmentStringsA
GetConsoleMode
GetConsoleCP
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
ExitProcess
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
RtlUnwind
GetCommandLineA
GetCurrentThreadId
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
VirtualQuery
GetSystemInfo
GetModuleHandleW
SetHandleCount
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStdHandle
HeapCreate
VirtualFree
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
VirtualProtect
VirtualAlloc
user32
CharNextA
GetDesktopWindow
GetWindowRect
GetDC
ReleaseDC
gdi32
SelectObject
DeleteObject
BitBlt
CreateCompatibleDC
DeleteDC
GetObjectA
CreateCompatibleBitmap
advapi32
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
shell32
SHGetSpecialFolderPathA
ole32
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
CoUninitialize
CoGetClassObject
CoCreateInstance
oleaut32
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
DispCallFunc
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetVartype
LoadTypeLi
LoadRegTypeLi
SysFreeString
SysStringLen
VariantClear
VariantCopy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
VariantInit
VarUI4FromStr
shlwapi
UrlUnescapeA
PathFindExtensionW
PathFindExtensionA
gdiplus
GdipDisposeImage
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup
GdiplusShutdown
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 174KB - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ