DllServer
Static task
static1
Behavioral task
behavioral1
Sample
WF.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
WF.dll
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_5374ae1c3e13351a60c1e98dbc4c4696a2994dc8d8c2f7361dd91e066cd04c8b
-
Size
110KB
-
MD5
cf02130ce90e72dcedfed67c16c98fbd
-
SHA1
44e69fac6dac559bef3a63187a971999a8d274bc
-
SHA256
5374ae1c3e13351a60c1e98dbc4c4696a2994dc8d8c2f7361dd91e066cd04c8b
-
SHA512
935e5c304bd67e02eb218bea090a48ff280006187d5f375c961fd1f2045a8897d99f09c5c03664901d16ddfe249a7ea7f6e599182e33edd27b401cc6c53af9fb
-
SSDEEP
3072:vQQg6vO1f82Ore9WotK8XlHe6EgjgJa3TcXWqkxDVkbl5C:o82Or+tKqHZEmg0Dca
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/WF.bin
Files
-
JaffaCakes118_5374ae1c3e13351a60c1e98dbc4c4696a2994dc8d8c2f7361dd91e066cd04c8b.zip
Password: infected
-
WF.bin.dll windows:4 windows x86 arch:x86
dfac67ad7aaa4f21935eeb32873faf9f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
GetActiveWindow
CheckDlgButton
CheckMenuItem
CheckRadioButton
CheckMenuRadioItem
kernel32
GetProcAddress
LoadLibraryA
VirtualProtect
VirtualAlloc
lstrlenA
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
ole32
OleInitialize
version
VerFindFileA
comdlg32
Ssync_ANSI_UNICODE_Struct_For_WOW
Exports
Exports
Sections
.code Size: 199KB - Virtual size: 199KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 654B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 276KB - Virtual size: 276KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE