winampGetInModule2
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_4ef9c87660765792f922af03b9bc0480.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_4ef9c87660765792f922af03b9bc0480
-
Size
184KB
-
MD5
4ef9c87660765792f922af03b9bc0480
-
SHA1
0467bf0d04030022e5e4eeeeaa24b0dfaec8657f
-
SHA256
4dc4f6e9a70ef746c1550e2b29a159394085a2d462bae7b4a1278b0671e9f3f6
-
SHA512
8be7d6d521841983a64230de46c4911ae4f3f9bc492cc87fad0ad40ac5d9c75f788d366458cabdf5f7d2ff753107a346dce9280f8240c43ed8c2d617955b8df1
-
SSDEEP
3072:x7ZMIfbhgBSX2KeK0VrLyVR84GnjLCX4Bwzd4d9G4ylrHBBBmFOZU7IEM0Tg8I4s:HMQhgQyrMR89j9KGd9hyxnehghN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_4ef9c87660765792f922af03b9bc0480
Files
-
JaffaCakes118_4ef9c87660765792f922af03b9bc0480.dll windows:4 windows x86 arch:x86
2bbffc57a02d8f786336ee27bc30b8ec
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LeaveCriticalSection
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
Sleep
CreateThread
GetTempFileNameA
GetTempPathA
DeleteFileA
CloseHandle
TerminateThread
WaitForSingleObject
SetThreadPriority
FreeLibrary
GetProcAddress
LoadLibraryA
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameA
DisableThreadLibraryCalls
EnterCriticalSection
user32
DialogBoxParamA
SetForegroundWindow
SendMessageA
GetWindowLongA
CreateDialogParamA
EndDialog
PostMessageA
GetActiveWindow
SetTimer
SetActiveWindow
DestroyWindow
GetDlgCtrlID
MessageBoxA
SetWindowTextA
GetDlgItemTextA
SetDlgItemTextA
EnableWindow
IsDlgButtonChecked
SendDlgItemMessageA
GetParent
CheckDlgButton
SetFocus
GetDialogBaseUnits
ShowWindow
SetWindowPos
SetWindowLongA
GetDlgItem
KillTimer
MoveWindow
GetSystemMetrics
OemToCharA
GetWindowRect
comdlg32
GetSaveFileNameA
msvcrt
strrchr
setlocale
atof
sprintf
_adjust_fdiv
_initterm
floor
fopen
fread
fwrite
fgetc
fputc
fseek
ftell
feof
fclose
rand
isalnum
tolower
toupper
_strdup
malloc
atoi
strncpy
_strnicmp
_stricmp
free
realloc
strncmp
calloc
strstr
strchr
_ftol
Exports
Exports
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rmnet Size: 56KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE