Static task
static1
Behavioral task
behavioral1
Sample
4231344d1ce6e29dc1519009220c0d28_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
4231344d1ce6e29dc1519009220c0d28_JaffaCakes118
-
Size
59KB
-
MD5
4231344d1ce6e29dc1519009220c0d28
-
SHA1
c727bd07221f9df4ddca772a93d47dc193d85001
-
SHA256
7b2870451fc861214c271b553ebd0b3f58dcfbfd22be14d34f38cc6173c82b2b
-
SHA512
ff1d6314faec17bd051908b356967aea1663b6d3babfd6d846b9c262258fc131759fcb699f2e4949c81befb993a77bdfbe356637ca6243834c30417d9d391f3d
-
SSDEEP
768:FzSV6P1ea7NG3arySvZlLJyaey+KThU9VP2hvHpQHwdQNRUiTiM6gU7brLF7R:oV6PVhxLyyKCF6wdQbOPgU/rlR
Malware Config
Signatures
Files
-
4231344d1ce6e29dc1519009220c0d28_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
50e938f9ce22c539216fef09300f63a5
Code Sign
3a:aa:24:d3:a7:9a:11:59:bd:5f:49:42:5d:b9:47:f4Certificate
IssuerCN=Root AgencyNot Before22/06/2009, 06:42Not After31/12/2039, 23:59SubjectCN=Microsoft(R) Windows Media Player,O=Microsoft(R) Windows Media Player38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcatA
GetCurrentThreadId
InitializeCriticalSection
FreeLibrary
GetProcAddress
HeapDestroy
DeleteCriticalSection
lstrcpyA
InterlockedIncrement
FlushInstructionCache
GetCurrentProcess
OpenProcess
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DisableThreadLibraryCalls
LoadLibraryA
CreateThread
TerminateThread
CloseHandle
GetModuleHandleA
GetShortPathNameA
MultiByteToWideChar
lstrlenW
GetVersionExA
GetModuleFileNameA
lstrlenA
InterlockedDecrement
user32
PostMessageA
wsprintfA
CharNextA
DestroyWindow
LoadStringA
CreateWindowExA
CallWindowProcA
GetWindowLongA
SetWindowLongA
DefWindowProcA
GetClientRect
EndPaint
GetDC
ReleaseDC
GetFocus
IsChild
GetClassInfoExA
LoadCursorA
RegisterClassExA
BeginPaint
gdi32
LPtoDP
SaveDC
CreateDCA
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
GetDeviceCaps
RestoreDC
advapi32
RegCreateKeyExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegSetValueExA
ole32
CoInitialize
CoCreateInstance
CoGetMalloc
StringFromIID
OleInitialize
oleaut32
SysStringLen
LoadRegTypeLi
DispCallFunc
SysAllocString
LoadTypeLi
RegisterTypeLi
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
VariantCopy
VariantClear
SafeArrayGetDim
SafeArrayGetElemsize
SysFreeString
SafeArrayGetUBound
msvcrt
malloc
_adjust_fdiv
_initterm
_onexit
__dllonexit
strtol
wctomb
_mbsnbcmp
_mbschr
_mbclen
_mbsnbicmp
sprintf
_strcmpi
wcslen
_mbsstr
free
_purecall
realloc
memcmp
_mbsicmp
time
srand
rand
atoi
strcpy
_mbsrchr
_except_handler3
strlen
__CxxFrameHandler
??3@YAXPAX@Z
memcpy
memset
??2@YAPAXI@Z
memmove
shlwapi
PathFindFileNameA
wininet
InternetGetConnectedState
msvcp60
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
psapi
GetModuleBaseNameA
EnumProcessModules
EnumProcesses
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ