Static task
static1
Behavioral task
behavioral1
Sample
14b82919d1d60eb7080163b01a8c1b90_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
14b82919d1d60eb7080163b01a8c1b90_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
14b82919d1d60eb7080163b01a8c1b90_JaffaCakes118
-
Size
40KB
-
MD5
14b82919d1d60eb7080163b01a8c1b90
-
SHA1
0caa7fa89b272c4ec01823c93cf72b3fc926abe0
-
SHA256
baf47fe681f59e9c911ce2102bca65453ccddfb85c3c6dbd2980f7577eb7011a
-
SHA512
2e68305249dbe76b92e35138479419c86a76ce639f61c62ca80c74569700dc04a442f8425f1071ccb3d57073d44e1264187bf93bbed965f02be22f8fc2d6e1eb
-
SSDEEP
384:yCBOExedBDVtmUjW5ZudekC0Qm1r8hAgyIJHnyIxY7f98ADDBlU:yT2UaKg0Qm5cDm7CAPI
Malware Config
Signatures
Files
-
14b82919d1d60eb7080163b01a8c1b90_JaffaCakes118.dll windows:4 windows x86 arch:x86
3bda43f07a3554b0c4e81ef13978c802
Code Sign
86:2b:d6:06:56:6a:96:4f:ab:8a:f3:ce:b1:af:deCertificate
IssuerCN=Root AgencyNot Before13/02/2010, 07:08Not After31/12/2039, 23:59SubjectCN=Micrcnsoft 模块Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
HeapDestroy
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
FlushInstructionCache
GetCurrentProcess
GetTickCount
InterlockedDecrement
GetModuleFileNameW
Sleep
GetSystemDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetShortPathNameW
lstrcpynW
lstrcpynA
GetVersionExW
LoadLibraryW
GetProcAddress
EnterCriticalSection
GetCurrentThreadId
lstrlenW
LeaveCriticalSection
user32
GetMenuItemInfoW
AppendMenuW
GetMenuItemCount
CreatePopupMenu
TrackPopupMenuEx
DestroyMenu
MonitorFromPoint
IsWindow
MapWindowPoints
PtInRect
GetClientRect
GetMonitorInfoW
MessageBeep
SetFocus
PostQuitMessage
LoadStringA
CallWindowProcW
GetWindowLongW
GetTopWindow
DispatchMessageW
TranslateMessage
GetMessageW
RemoveMenu
InvalidateRect
GetParent
GetClassNameW
GetWindow
SendMessageW
GetWindowTextW
GetCursorPos
GetWindowRect
SetCursorPos
mouse_event
KillTimer
PostMessageW
SetTimer
GetLastInputInfo
DefWindowProcW
TranslateAcceleratorW
GetClassInfoExW
LoadCursorW
wsprintfW
LoadImageW
RegisterClassExW
SetWindowLongW
CreateWindowExW
LoadStringW
LoadMenuW
LoadAcceleratorsW
DestroyWindow
PeekMessageW
SetWindowPos
shell32
ShellExecuteW
advapi32
RegQueryValueExW
RegSetValueExW
RegOpenKeyW
RegCloseKey
RegCreateKeyExW
ole32
OleUninitialize
OleInitialize
msvcp60
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Xlen@std@@YAXXZ
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
msvcrt
__CxxFrameHandler
free
realloc
_initterm
memmove
??2@YAPAXI@Z
_purecall
wcscpy
wcsstr
wcscat
wcslen
malloc
_adjust_fdiv
_wcsicmp
Exports
Exports
DllRundll
iiuuu
setxml
tdtss
tssdtdssddsss
upsss
yyiisadfasd
Sections
.text Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 716B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ