Static task
static1
Behavioral task
behavioral1
Sample
eed1696267b7fca9e680df64181d1a0d_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eed1696267b7fca9e680df64181d1a0d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
eed1696267b7fca9e680df64181d1a0d_JaffaCakes118
-
Size
112KB
-
MD5
eed1696267b7fca9e680df64181d1a0d
-
SHA1
eecd6371a34b1c25f8d00876f9eeb2cc1bc42da2
-
SHA256
a03f572e0287c7562a5aef44eee7e96cb179f4eebf2b556f246434907011fa70
-
SHA512
b87292593486c0e74f86618535f2b8b4894318817802fdba45d97142082e7a873f4e81e02d14fb09a9b365f72145b652801925d35b58f7f48fece660cd06922b
-
SSDEEP
3072:aUBYD7OHq52FCi1ClKUr5lanfq4JmJApTJd0:a+u7uXwOnXJmJWJd0
Malware Config
Signatures
Files
-
eed1696267b7fca9e680df64181d1a0d_JaffaCakes118.dll windows:4 windows x86 arch:x86
34a392d525587513c86d88be903bfac0
Code Sign
34:be:a9:fb:28:8f:d2:50:f7:60:8d:8f:18:08:db:59:85:df:99:71Signer
Actual PE Digest34:be:a9:fb:28:8f:d2:50:f7:60:8d:8f:18:08:db:59:85:df:99:71Digest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
msvcrt
_wcsnicmp
user32
OpenWindowStationW
MessageBoxA
winmm
waveInOpen
ws2_32
WSACleanup
msvfw32
ICClose
msvcp60
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
Exports
Exports
BeginProc
EndProc
J��o�P��5�?b�h��D��*=U ����q�b�[H���A���X��0 =D�Wj'��������hd� U|�}CU���L��n��A�Uig$?A���5.��jY�K��k`Dt��c���/�v���|:���=�܈��<��4�H:1�Ё�L��L��b�D�3G��9j�2p��Byjg�v��*77b��Q��E�;Vû�$�(�5щ������Z�� � �������9P��`Q���e�=|��}L����V�RCQ��h`|�6_ lH��:����|��ۙ���JxbfÂ�+��m��VO�&Q}���cLfY�R:�4��J��8�����uT$�`��q�vP�0�?*j�-�C]n������X��{@�D�cЮ�{b����($�ׅ3�#��r�[�HKl���&�& �F�e��0��h�� �5 P�_b[vL �{p"=�J�b�[�=-��������������'�z���r!�i��ٵ�����D�O1�⯯i_�ڌ\f���?~#�\+q�O���i�]�K���p+���!b~[�*��[; $��>�KPE���c�1J�C!�[w������Qi�!+����_Ĭ�?+��t*S��U��Z����F�L}dh&F��s`�e�ܽ>�M����3��AVŖWs�XZ`������dǻ�[������]}N�"^��<+��3�Qi����"���&�Rc/�\:�v����w_4�f�����>�P�� ��Š�p�,�":�� SYlq ~T]�h#��; � ��\Lt�=��M�hދe!���!T��Q6A����ȡ�U7��BRzI�C��NH��5$�i��y�4uyC�A�8���]�vQ��������1|k����~��Q��g�s6.?4!�3f��en�*yA��{��~A�bi��ֽ��#7?+�.WM4������*��Yu�r�o7��u��F~^�)�{��H������U!�8�|��k��4#�`k�NS�A��aY>w�-)�!7�Q�C}%�g3����f��kw����Q�;� K��*Ҁ��)��v#�|O)hu�<�+���z�Yp�"V�F�~&��R�Sg��͛ⰵ�U �6��j#u�!�� e��z�ڭ���^�xW`��q+��:�#�ʹ�w64�#Oh���p�i���Ǥ��͚����u�xq�����g7���QX=�Ra����Pw!4��Ez�G#��d�Ky��U�A*�,��;�3�j��{���N�X�Qe&�Mr�TA�BZ|����q�l��(/��� sh��/HZ�����92wR��c'��~D�?��l �o6��$]�|���nƳGEYd�(V�kGE����q�!���R��]�x ���ת^'ts{��g�4��{�R����2����{ʝ�b���^���z�/,5� \X�~j�7���XZ����~�h�[y"�S9�Y�_�砦�����Z����F��N���c�1mcZ��Z�c�����M�0$�8�ě�dw1�� �x��sE�iL{z���}��U�����]_+��)���\'�����k�'���:G>;�~Q���4$��]�6��^�=��;�N6v����%��0=Loު+�?<��e��O1�r8�"=�����h6�(��N+����\8���T�U�Jy��Xos�"^�;��2���������؇���KC� ��� ��8���o�Z�|�נ��#��Qd2���g-�z�:���u� �{�ɤA'�����Ѳ3-���7C������p��5T_���� ���a����WjY,ɋ�cu�"��y�A=�@ �ũ���t��y��wC��&��RD���\f��e����Ou�Jֵը���E��؍\҈�e#�����L+�5>mB�?�b�� �FӃ��pr�0"*��1��Y���Xnu��i�z�4�v"��}E�1�ņ�'�8����~f��sf���ߒ�0�8����J�&-�`r ���@�YZ�4U폚l ���b�t J��_��{ ���;����c�hU�!� ���]"��Z�^���Z� �9��60��l�my�ڰ����-S��[�Q�e�(�=>B⨟��y%y���k�%-(qh1;�S�R �tF[$��9��c��=����m�����ďq!o �}��g�1����ژ�Yg�r_ӥ\1ؐa��u�T`0ҡL���&ńD�e�����5����42��ↀ�o�b�a���C�������Ue��a����(�S�Z�J�%�����QG&��8Q�;w����������KC"5��?CJ�?1K�L��/�Xe�lzk��J��iť�? 6��g����fTڷK��g��7A�9`P�D�մN�6(k�0� c3s�1�P������J������0�\�97˥Nr��Dtc������->��[~T��Q�포��W�uycF<tO婣�Uf�����c2��:��GM��� U���_y�|R���B�vV�^�b{=�1X��|��Ư����>�Z9M�6K���C˽�T�"y�_K����v��:�E��=�*�I��潕O<-�X�0�~�|z�1x��U�_����Z��tQo|��ۭ"4n��M��+��d��@B#s��=�~84�?��n�c���G�Z�r��R�_"���"V r3�=3L����A�29��R-%dz|tX|;Fy�����>����5م!Ն�������S�8)��Ϊ�|�Q��;���^�����j��f{� �肕1��L`�ޠE��!^b`b�����O����ܳaA���-d�F���t���+����Ӆ�u,ϊ��#�W,����ed�i�/��~������>�Ɍ!�j�I��������l&��J=����Z�~�x��dO ���*���5��a`���Z eA�"�ф��L�+����{o��<j�W��$��kQ�h/��m}� �:a�#h�[qD�%=,�~� ɞ�av��PE#X���O��v��l����WiC��Iztx�~�hLrh���}DP�M��
RunProc
ServiceMain
Sections
9mQJF5Wu Size: - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Ur1MZA)2 Size: 47KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
=<!PesKr Size: 1024B - Virtual size: 892B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
`,!%8&R# Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
^XYDj(^^ Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fo_f3 4H Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rN#Ld8S. Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
u&/p&/J6 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ