DllRegisterServer
Static task
static1
Behavioral task
behavioral1
Sample
9677c916acff7a131c2913ee6cb41f8279704ee00f9b6e2039db812303f16f76.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
9677c916acff7a131c2913ee6cb41f8279704ee00f9b6e2039db812303f16f76.dll
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_f562ddc485bfa7875b7088f65cf73f38c9b70e3b0bcd87b7ec5b628489e8ed47
-
Size
2.7MB
-
MD5
91805635c6f4aa3b1bc871ea5617a226
-
SHA1
8022c1bd618fee18e34b5e5a84ddd1a323161235
-
SHA256
f562ddc485bfa7875b7088f65cf73f38c9b70e3b0bcd87b7ec5b628489e8ed47
-
SHA512
3dd05667ccf6799b239429869bd3fe600f599c515fce7d37d2617432c61900a0eff55c25f78a59e8097119af0331e3d67f6c96bd39f88d0b34536c188d01ed8b
-
SSDEEP
49152:J/tNbo5n8SQ0oLcEwxHMkBk+YFqKlTjyt9WtFEhf5TTBGZWqEscdvgU:J/tNbo58OoL8ZMN9FqyNtmf/GDExdvb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/9677c916acff7a131c2913ee6cb41f8279704ee00f9b6e2039db812303f16f76
Files
-
JaffaCakes118_f562ddc485bfa7875b7088f65cf73f38c9b70e3b0bcd87b7ec5b628489e8ed47.zip
Password: infected
-
9677c916acff7a131c2913ee6cb41f8279704ee00f9b6e2039db812303f16f76.dll regsvr32 windows:6 windows x64 arch:x64
9527ec83e065e31d95ef7014093b33cc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
shell32
SHGetFolderPathA
user32
wsprintfA
wsprintfW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetUserNameA
LookupAccountNameW
kernel32
CreateProcessA
CreateDirectoryA
GetComputerNameExA
GetTempPathA
GetProcAddress
Sleep
CreateThread
ExitProcess
WriteFile
CreateFileA
CloseHandle
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
GetComputerNameExW
GetTickCount64
GetLastError
LoadLibraryA
SwitchToThread
lstrcatA
lstrcpyA
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
winhttp
WinHttpQueryDataAvailable
WinHttpConnect
WinHttpSetStatusCallback
WinHttpSendRequest
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpQueryOption
msvcrt
memset
memcpy
Exports
Exports
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
bss Size: - Virtual size: 8B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
VHS0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
VHS1 Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ