Static task
static1
Behavioral task
behavioral1
Sample
0ad30a176af6338d0bfdaaf945881a03_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0ad30a176af6338d0bfdaaf945881a03_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0ad30a176af6338d0bfdaaf945881a03_JaffaCakes118
-
Size
36KB
-
MD5
0ad30a176af6338d0bfdaaf945881a03
-
SHA1
de26c92d61d489e90dd21ddd44eca7f5173f1e81
-
SHA256
f708076f49183ca5b0db9f589b76f4b8d105ad6d6d7792c535e8f749d2df600b
-
SHA512
22b83738fc647d4bc8a58dd9676d83163c4ee7d9617d7d08029b83634a9db468033a122ee8be829b4d4fbfc763f8c1ce2a9284ca0d0f3bb189ea20b187d3af7a
-
SSDEEP
384:CzMZECDHY0fu4lJniTYhf5JYqaQblLaFyUi+JE39z4gJudCV:CzMZDu4l5ld5vlLaFyUXayFdE
Malware Config
Signatures
Files
-
0ad30a176af6338d0bfdaaf945881a03_JaffaCakes118.dll windows:4 windows x86 arch:x86
e830f38d67a1b5d6f4b667fcbd5e3720
Code Sign
11:f3:af:c3:27:d0:1e:a0:4b:6d:03:1a:ce:d9:5c:a2Certificate
IssuerCN=Root AgencyNot Before08/12/2009, 07:34Not After31/12/2039, 23:59SubjectCN=Microsofft 模块Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentThreadId
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
DeleteCriticalSection
FlushInstructionCache
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
GetTickCount
DisableThreadLibraryCalls
lstrcatA
GetSystemDirectoryA
GetFileAttributesA
GetWindowsDirectoryA
GetShortPathNameA
DebugBreak
OutputDebugStringA
lstrcpynA
lstrcpynW
GetModuleFileNameA
GetVersionExA
lstrlenA
LoadLibraryA
GetProcAddress
Sleep
user32
CharNextA
PostQuitMessage
SetFocus
LoadStringW
SetWindowPos
GetClientRect
MessageBeep
DestroyMenu
AppendMenuA
GetMenuItemInfoA
wvsprintfA
CreatePopupMenu
TrackPopupMenuEx
IsWindow
GetWindowLongA
PtInRect
RemoveMenu
InvalidateRect
GetMonitorInfoA
MonitorFromPoint
GetMenuItemCount
GetTopWindow
GetClassNameA
GetParent
GetWindow
SendMessageA
GetWindowTextA
GetCursorPos
ShowWindow
FindWindowA
LoadAcceleratorsA
MapWindowPoints
DefWindowProcA
mouse_event
GetWindowRect
SetCursorPos
KillTimer
PostMessageA
GetLastInputInfo
SetTimer
TranslateAcceleratorA
GetClassInfoExA
LoadCursorA
wsprintfA
LoadImageA
RegisterClassExA
SetWindowLongA
DestroyWindow
CreateWindowExA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
LoadStringA
LoadMenuA
CallWindowProcA
shell32
ShellExecuteA
advapi32
RegCloseKey
RegSetValueExA
RegOpenKeyA
RegCreateKeyExA
RegQueryValueExA
ole32
OleUninitialize
OleInitialize
msvcrt
memset
atoi
isdigit
wcslen
strstr
strcat
strcmp
_purecall
memmove
realloc
??3@YAXPAX@Z
memcpy
??2@YAPAXI@Z
free
strrchr
__CxxFrameHandler
strcpy
strlen
_except_handler3
_initterm
malloc
_adjust_fdiv
Exports
Exports
CetxEml
DllRundll
aetxEml
awcweljkdafasdf
betxEml
setxml
ttss
Sections
.text Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 732B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ