Static task
static1
Behavioral task
behavioral1
Sample
120e3a8875e864195452282ae530e122_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
120e3a8875e864195452282ae530e122_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
120e3a8875e864195452282ae530e122_JaffaCakes118
-
Size
36KB
-
MD5
120e3a8875e864195452282ae530e122
-
SHA1
75d16e561b2ff3f3f17c4c14ce90810ff20fab15
-
SHA256
1dcd25d882a9f9388869fd3863d3042b66472724ce61b5ed53cdb18b337b1778
-
SHA512
4808f559d5ea3fb6910abf6058a9a10083411ec361338efd45aa90f54bde0bc66e8959f4a5c1f990936b341dc528a57b63fd18b21d6a62256e0d803af9cda647
-
SSDEEP
384:jzMZECDHY0fu4lVTiTYhf5JYqaQblLaPyUi+JE3904gJu1CVv:jzMZDu4lhld5vlLaPyUXaZF1E
Malware Config
Signatures
Files
-
120e3a8875e864195452282ae530e122_JaffaCakes118.dll windows:4 windows x86 arch:x86
e830f38d67a1b5d6f4b667fcbd5e3720
Code Sign
11:f3:af:c3:27:d0:1e:a0:4b:6d:03:1a:ce:d9:5c:a2Certificate
IssuerCN=Root AgencyNot Before08/12/2009, 07:34Not After31/12/2039, 23:59SubjectCN=Microsofft 模块Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentThreadId
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
DeleteCriticalSection
FlushInstructionCache
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
GetTickCount
DisableThreadLibraryCalls
lstrcatA
GetSystemDirectoryA
GetFileAttributesA
GetWindowsDirectoryA
GetShortPathNameA
DebugBreak
OutputDebugStringA
lstrcpynA
lstrcpynW
GetModuleFileNameA
GetVersionExA
lstrlenA
LoadLibraryA
GetProcAddress
Sleep
user32
CharNextA
PostQuitMessage
SetFocus
LoadStringW
SetWindowPos
GetClientRect
MessageBeep
DestroyMenu
AppendMenuA
GetMenuItemInfoA
wvsprintfA
CreatePopupMenu
TrackPopupMenuEx
IsWindow
GetWindowLongA
PtInRect
RemoveMenu
InvalidateRect
GetMonitorInfoA
MonitorFromPoint
GetMenuItemCount
GetTopWindow
GetClassNameA
GetParent
GetWindow
SendMessageA
GetWindowTextA
GetCursorPos
ShowWindow
FindWindowA
LoadAcceleratorsA
MapWindowPoints
DefWindowProcA
mouse_event
GetWindowRect
SetCursorPos
KillTimer
PostMessageA
GetLastInputInfo
SetTimer
TranslateAcceleratorA
GetClassInfoExA
LoadCursorA
wsprintfA
LoadImageA
RegisterClassExA
SetWindowLongA
DestroyWindow
CreateWindowExA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
LoadStringA
LoadMenuA
CallWindowProcA
shell32
ShellExecuteA
advapi32
RegCloseKey
RegSetValueExA
RegOpenKeyA
RegCreateKeyExA
RegQueryValueExA
ole32
OleUninitialize
OleInitialize
msvcrt
memset
atoi
isdigit
wcslen
strstr
strcat
strcmp
_purecall
memmove
realloc
??3@YAXPAX@Z
memcpy
??2@YAPAXI@Z
free
strrchr
__CxxFrameHandler
strcpy
strlen
_except_handler3
_initterm
malloc
_adjust_fdiv
Exports
Exports
CetxEml
DllRundll
aetxEml
awcweljkdafasdf
betxEml
setxml
ttss
Sections
.text Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 732B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ