c:\work\0047.BHO\bho\BHO_full_tbws\release\vmmreg32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e17b93f503376989b55f0591c791e953_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e17b93f503376989b55f0591c791e953_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
e17b93f503376989b55f0591c791e953_JaffaCakes118
-
Size
280KB
-
MD5
e17b93f503376989b55f0591c791e953
-
SHA1
dc0d02a817231a195f0db4d6c5b3343055d30653
-
SHA256
453c206c6ea6dcb57c353d005599e61a90d096cabdf58fc49c2abd60984b706f
-
SHA512
39f6f5bdc659546b01ae8525d84dab338f11ab76f48b3e5e578cc08310c7f4324fb695061056bd3da8eb9d940179fa6f344d51e6cfcd3be20def50134fee9cf9
-
SSDEEP
3072:H1xEcvtag4cl2EcVX/B2xApB8814JbVtPI0kr4HED3IINNKnLt3IVW91ysSwDfND:/TFamcckX1+fwnUQIzn10Yt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e17b93f503376989b55f0591c791e953_JaffaCakes118
Files
-
e17b93f503376989b55f0591c791e953_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
a4fef1a110ed10653f62b81edeaa2b41
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
winhttp
WinHttpSetDefaultProxyConfiguration
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
psapi
EnumProcessModules
EnumProcesses
GetModuleFileNameExW
kernel32
LockResource
LoadResource
FindResourceW
FindResourceExW
MultiByteToWideChar
GlobalFree
GetLastError
Sleep
GetWindowsDirectoryW
DeleteFileW
FreeLibrary
GetCurrentProcess
GetProcAddress
LoadLibraryW
OpenProcess
lstrlenA
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
lstrcmpiW
GetModuleFileNameW
FindClose
FindNextFileW
FindFirstFileW
CreateDirectoryW
WaitForMultipleObjects
FindFirstChangeNotificationW
CreateEventW
InterlockedIncrement
InterlockedDecrement
LoadLibraryExW
GetModuleHandleW
SetThreadLocale
GetThreadLocale
CreateThread
SizeofResource
WaitForSingleObject
SetFilePointer
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileAttributesW
GetCurrentDirectoryW
SetFileTime
FileTimeToSystemTime
GetFileSize
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingW
GetLocalTime
UnmapViewOfFile
GetTickCount
InterlockedExchange
GetACP
GetLocaleInfoA
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetStringTypeW
GetStringTypeA
lstrlenW
WriteFile
WideCharToMultiByte
SetEnvironmentVariableA
CreateFileW
ReadFile
CloseHandle
GetExitCodeProcess
CreateProcessA
GetFileAttributesA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
CompareStringA
CompareStringW
GetModuleHandleExW
LoadLibraryA
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
GetOEMCP
GetCPInfo
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapCreate
VirtualAlloc
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
VirtualFree
user32
CharNextW
wsprintfW
UnregisterClassA
GetDesktopWindow
advapi32
CloseServiceHandle
RegEnumKeyExW
GetUserNameW
RegEnumValueW
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegNotifyChangeKeyValue
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegSaveKeyW
CreateServiceW
OpenSCManagerW
OpenServiceW
StartServiceW
RegCreateKeyW
RegRestoreKeyW
RegCloseKey
ole32
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
oleaut32
VarUI4FromStr
SysFreeString
SysAllocString
LoadTypeLi
LoadRegTypeLi
DispCallFunc
VariantClear
VariantInit
RegisterTypeLi
SysStringLen
shlwapi
SHRegCreateUSKeyW
SHDeleteKeyW
SHRegSetUSValueW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllRunThreads
DllUnregisterServer
Sections
.text Size: 136KB - Virtual size: 134KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ