Static task
static1
Behavioral task
behavioral1
Sample
5443d95a9c165ac023afd1d6e0239648_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5443d95a9c165ac023afd1d6e0239648_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
5443d95a9c165ac023afd1d6e0239648_JaffaCakes118
-
Size
44KB
-
MD5
5443d95a9c165ac023afd1d6e0239648
-
SHA1
d6e548becd1cf2e82de1383b73d035347ebfc5fe
-
SHA256
7de826c33045b1c688ee45fff9aa9fe955428b46071da39619060012d87e15ae
-
SHA512
91980cb7b742c48ea8ee4df464bc16209614dc0f2efd95aea2673c4d8672e13f96ad8c87dd266f16944e392b2d9154f5d44fad72d58dbe4dfde79b1b96ed07d4
-
SSDEEP
768:LfbPRRpCtZk1Saa2fDouYFm/C3I9Pl4l+0Z2NYbVAE:bcR8brYU6I9Pl4l5QuVT
Malware Config
Signatures
Files
-
5443d95a9c165ac023afd1d6e0239648_JaffaCakes118.dll windows:4 windows x86 arch:x86
baf4dc805cbc959c585ba1669e184fca
Code Sign
11:f3:af:c3:27:d0:1e:a0:4b:6d:03:1a:ce:d9:5c:a2Certificate
IssuerCN=Root AgencyNot Before08/12/2009, 07:34Not After31/12/2039, 23:59SubjectCN=Microsofft 模块Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpyA
lstrcatA
InterlockedIncrement
GetCurrentThreadId
InitializeCriticalSection
HeapDestroy
LoadLibraryA
InterlockedDecrement
FlushInstructionCache
GetCurrentProcess
DebugBreak
OutputDebugStringA
lstrlenW
GetProcAddress
FreeLibrary
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
MultiByteToWideChar
lstrlenA
DisableThreadLibraryCalls
DeleteCriticalSection
Sleep
user32
wsprintfA
CharNextA
DestroyWindow
DefWindowProcA
RegisterClassExA
LoadCursorA
GetClassInfoExA
IsChild
GetFocus
ReleaseDC
GetDC
CharLowerA
CallWindowProcA
GetWindowLongA
CreateWindowExA
EndPaint
GetClientRect
BeginPaint
SetWindowLongA
wvsprintfA
PostMessageA
LoadStringA
advapi32
RegCloseKey
RegCreateKeyExA
RegSetValueExA
ole32
StringFromIID
CoGetMalloc
CoCreateInstance
oleaut32
RegisterTypeLi
LoadTypeLi
SysAllocString
LoadRegTypeLi
SysStringLen
DispCallFunc
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
VariantCopy
VariantClear
SafeArrayGetDim
SafeArrayGetElemsize
SysFreeString
gdi32
RestoreDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
CreateDCA
DeleteDC
msvcrt
memmove
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
atoi
_ismbcdigit
wcslen
_mbsicmp
_mbsstr
free
_purecall
memcmp
??2@YAPAXI@Z
memset
memcpy
__CxxFrameHandler
strlen
strcpy
fopen
strstr
strncpy
strftime
localtime
time
strchr
fclose
??3@YAXPAX@Z
Exports
Exports
AHtJthIpVrVAiXt
BAFGcoVdopgifOb
BHJeVpEXJQqFGXA
BVEnYsaTdWNoAlh
BhSIAfPVF_c
DVHdZshGZYPbWDK
DiNZfQOgbQLWbgs
DllCanUnloadNow
DllGetClassObject
DllSSS
DllUnregisterServer
EjKorlMGQKWmRDo
EkaEAKHgVjEjDae
FDhhkMUTbBVGfIt
FbpCtMcBbSrVUEt
FfQiEYVlPiGXAJK
FgEEjDbFWJRWanG
FpGRCrFafVmTLQg
GLRdKKPMW_j
GSAkqrPSg_g
GVChWcOBQjOrIDM
GchDqXAKHRnhLAP
GhjbEUPQSDgmLWe
GsrlZiiZrllcdXZ
HBFJLLBBKIXeAdG
HOXehSZtNIBaaVE
HhBmnMGkKiJLsIB
HiQNTSeIATIKlaD
HqUefqegMgtIXEm
HrXlUKCRjWWtJkQ
IBTCkTIbULkbTPS
IFaIXThrKalHVmQ
IJSOddpWTJoLlpT
IOsPSEIeLYiYhVh
IOtTDXgQRWSOJUS
IhSNMKEfrMDLbrG
JoIreQcWhffNYrZ
KfCnnBUncqNYaUr
KqARUNPZXjTTTmE
LRGMnIBAVcLTqgf
LfPShsNKD_d
LhWacWMPM_8
LimPDTVXF_l
MSoAobpIC_7
MbRNkHOnmYPOVGe
MjkNgBMgbkLlKCa
MjtfeEDPfSdnimM
NNqIHVZEHJOPJAn
NUlQpkDrcCVOVnD
OrhXorHMnKUGrXb
OtAbHcFqApMLZNb
PGFKXFXIULJkjnt
QCBYeIXPAKLmIOC
QXILUqrHlaMkSYP
QhGDgCPVekgBRCV
QmRXRMfZBLTNBIE
RDnNjWKSkftsDJL
RJGWahnLPbZTbFD
RXFOJcAUXWCZrcK
SANFJjNjWPgFLeM
SMMAUIgHY_9
TSJlDhWrh_b
UWidLSKFtdeblWE
UfUiNGSsp_a
UjXHkIsSOUONqth
VldbOeciA_m
WOPdpXJnjrJRYCA
WclLNHPRUlAnUgO
WdlEDFeYrgjZYaB
WgqYrRBgBhGqNMR
XcLUcjBlrcqDopH
ZHgQTTXDaJrBFeK
ZQnYREefApaCdmb
ZkJJDOsMhYkHtrt
ZkpAlfSWO_4
aafnWcKZsOOAEEj
adtYZfFMjVXWdKB
agHGrYHbW_i
arVUOKGOMoLZKOi
bNIMtEAOr_e
bcWgbmDqA_3
cWhmmgmibIqDHDq
cYTWOLEWhLCUNhg
cnIeDQQOrOgSAaS
dIaZUCOkXbOlhef
eaqefYgSgbJqcFB
eoAikkHssIcEJcl
fDPUSIIClKkhHre
fqQntGRlYSEWBNp
gIrqtJYYToqDjnn
gNhoZUKNfeceWSo
gpXNpQdCUEhIdcP
hBgLFhWnS_2
hGQVtTqbH_k
heOgTtprk_f
hioAYoPsQjGlUsg
hmLhfbSLSJCbMBY
iCSJkdlgiedgdtj
isXKSMQGTTgjMNU
itdlereRHJbghXp
jAgWoclVG_5
kImQqTPqFQanNYW
kiSKeQrpOXiVMWY
lZEEGZbsYBhcCVe
mKXUtRRmMGkRmfJ
mLsFtSsABeCqPAr
mfKdILFbBWlrenZ
nYQVqLchl_n
nfanLPPYHREJAQP
oAtdfDLVGbpCUEF
oCXXeWHYQNOVDZi
oaRcLbVSSUmVafG
ofWaqeCVDLFRckJ
pChUdNDbo_1
pQQniHGRpGHPGLp
qFXUWCYbQsdShan
rVBcjMcIVNOGVaG
rZidrnJDkFIMUTr
raFneNDeqeUJFqh
rcoOtHAgeYpnDeQ
sbrhjglnO_h
sddNbePkm_6
tKkNOhBJXDEVjJQ
tUtPssVomLUOkPG
Sections
.text Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ