Static task
static1
Behavioral task
behavioral1
Sample
07df4d18201a1cf5654fa7c55b540c92_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
07df4d18201a1cf5654fa7c55b540c92_JaffaCakes118
-
Size
593KB
-
MD5
07df4d18201a1cf5654fa7c55b540c92
-
SHA1
6d618c8d6f31a80a1211e079a2da4783e4219307
-
SHA256
b3873716da4bb0f26f3fdc562ca290bddd9a099410ceb5f898f8ba1858903879
-
SHA512
9eb8c869295d9e1fc419492044807433600d5c6c26629d3ef9241c57e9b65a2d0c97caf5dfccb275cd7da0d29b8d73dae2fa17f27bafd71a553a8bead06a0d62
-
SSDEEP
12288:yZVirqFWl9o/JGgue2Ej8JowNJ1jEow7XWWUnK7:oVirm29osEjCowHmow7XpUnK7
Malware Config
Signatures
Files
-
07df4d18201a1cf5654fa7c55b540c92_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
4733441b8698160c7532a1c94085673e
Code Sign
70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before29/01/1996, 00:00Not After01/08/2028, 23:59SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before16/07/2004, 00:00Not After15/07/2014, 23:59SubjectCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
62:e7:fc:1f:ca:14:da:7f:f0:ca:48:cf:fa:79:76:e6Certificate
IssuerCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USNot Before26/07/2006, 00:00Not After16/09/2009, 23:59SubjectCN=Rediff.com India Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=India,O=Rediff.com India Limited,L=Mumbai,ST=Maharashtra,C=INExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
winmm
PlaySoundA
timeSetEvent
timeKillEvent
shlwapi
PathFileExistsA
wininet
InternetSetOptionA
FindCloseUrlCache
InternetOpenUrlA
InternetCrackUrlA
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetQueryOptionA
DeleteUrlCacheEntry
HttpQueryInfoA
InternetReadFile
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
setupapi
SetupIterateCabinetA
kernel32
LocalFree
LocalAlloc
InterlockedExchange
GetVersionExA
RemoveDirectoryA
DeleteFileA
CloseHandle
WriteFile
CreateFileA
GetTempPathA
MoveFileExA
Sleep
GetModuleFileNameA
GetLastError
SetEvent
WaitForSingleObject
CreateMutexA
InterlockedIncrement
InterlockedDecrement
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
FreeLibrary
FindClose
FindNextFileA
GetProcAddress
FindFirstFileA
lstrcpyA
RaiseException
SetLastError
LoadLibraryA
OutputDebugStringA
LoadLibraryW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
TerminateThread
DebugBreak
GetCurrentThreadId
GetVersion
GetCurrentProcessId
GetTickCount
GlobalUnlock
GlobalLock
GetVolumeInformationA
GetDriveTypeA
GetLogicalDriveStringsA
CopyFileA
MoveFileA
GetTempFileNameA
ReleaseMutex
ResetEvent
CreateEventA
LeaveCriticalSection
EnterCriticalSection
GlobalAlloc
FlushInstructionCache
GetCurrentProcess
lstrcmpA
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThread
HeapFree
HeapAlloc
GetProcessHeap
SetCurrentDirectoryA
DisableThreadLibraryCalls
HeapDestroy
GetShortPathNameA
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
lstrcatA
user32
SendMessageA
wsprintfA
GetSysColor
CallNextHookEx
GetSubMenu
CharLowerA
GetClientRect
EndMenu
SetWindowTextA
GetSystemMetrics
IsWindow
GetParent
FillRect
ShowWindow
DestroyCursor
PostMessageA
EmptyClipboard
UnregisterClassA
TranslateMessage
SetActiveWindow
MoveWindow
EnableMenuItem
CheckMenuItem
AppendMenuA
CreatePopupMenu
LoadCursorFromFileA
GetActiveWindow
CreateWindowExA
GetDlgItem
InvalidateRgn
SetCapture
ReleaseCapture
DestroyAcceleratorTable
CreateAcceleratorTableA
GetDesktopWindow
RedrawWindow
BeginPaint
EndPaint
IsChild
SetFocus
CallWindowProcA
DestroyWindow
DrawEdge
OpenClipboard
GetClipboardData
CloseClipboard
GetWindowTextLengthA
GetWindowTextA
DefWindowProcA
GetClassInfoExA
RegisterClassExA
RegisterWindowMessageA
LoadCursorA
SetWindowRgn
ReleaseDC
GetDC
OffsetRect
GetMenuItemInfoA
CopyRect
GetWindow
UnhookWindowsHookEx
IsWindowVisible
GetAsyncKeyState
CharUpperA
LoadMenuA
InsertMenuA
TrackPopupMenu
DestroyMenu
PeekMessageA
DispatchMessageA
FindWindowA
MapWindowPoints
GetWindowRect
LoadImageA
GetMessagePos
GetCursorPos
GetFocus
GetWindowLongA
SetWindowLongA
SetWindowPos
SetWindowsHookExA
LoadStringA
WindowFromPoint
SetTimer
SetCursor
ScreenToClient
PtInRect
GetKeyState
GetClassNameA
InvalidateRect
wvsprintfA
KillTimer
CharNextA
MessageBoxA
gdi32
CreateBrushIndirect
CreateSolidBrush
GetTextExtentPoint32A
CreateCompatibleBitmap
GetStockObject
GetTextExtentPointA
ExtTextOutA
DeleteObject
SelectObject
GetTextMetricsA
SetBkColor
SetBkMode
SetTextColor
CreateFontA
CreateRectRgn
GetObjectA
GetDeviceCaps
DeleteDC
BitBlt
CreateCompatibleDC
shell32
DragQueryFileA
SHAddToRecentDocs
ShellExecuteA
ole32
CoCreateGuid
CoCreateInstance
CoInitialize
ReleaseStgMedium
CoUninitialize
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
RegisterDragDrop
OleRun
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree
StringFromCLSID
CoTaskMemAlloc
OleLockRunning
CoTaskMemRealloc
oleaut32
GetErrorInfo
VarUI4FromStr
RegisterTypeLi
OleCreateFontIndirect
DispCallFunc
LoadRegTypeLi
SysFreeString
SysAllocString
SysAllocStringByteLen
SysStringLen
VariantClear
SysAllocStringLen
VariantInit
SysStringByteLen
VariantChangeType
LoadTypeLi
VariantCopy
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
rpcrt4
UuidFromStringA
msvcp60
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??8std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??1out_of_range@std@@UAE@XZ
??0out_of_range@std@@QAE@ABV01@@Z
??0logic_error@std@@QAE@ABV01@@Z
msvcirt
??0exception@@QAE@ABV0@@Z
msvcrt
memset
__CxxFrameHandler
memmove
memcmp
strlen
??2@YAPAXI@Z
strrchr
strcpy
strcat
fclose
fgets
fopen
strtok
strstr
free
_beginthread
memcpy
_purecall
difftime
mktime
localtime
time
atoi
_except_handler3
strcmp
_stricmp
wcslen
isdigit
sprintf
_itoa
wcsncpy
_fullpath
isspace
wcschr
wcsstr
wcscmp
rand
_mkdir
_chdir
strchr
wcscpy
strtod
srand
_CxxThrowException
realloc
wcstol
wcstod
_strlwr
fread
ftell
fseek
_wcsicmp
malloc
fwrite
__dllonexit
_onexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
Exports
Exports
CanReload
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TBStudioReg
Sections
.text Size: 400KB - Virtual size: 399KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SHARED Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 48KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ