XactEngine2_2.pdb
Static task
static1
Behavioral task
behavioral1
Sample
03666516e7b3a4693b283e640b580a96_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
03666516e7b3a4693b283e640b580a96_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
03666516e7b3a4693b283e640b580a96_JaffaCakes118
-
Size
839KB
-
MD5
03666516e7b3a4693b283e640b580a96
-
SHA1
4c8e108dc35ee43bf2aa0d03dd60d29fc1b3a305
-
SHA256
e0e78c51f0542595fac86a36c3e90f8cff409d56dd0dfe4c3c63d0d2ec25939c
-
SHA512
c1d5f391b9d677399ca9b1200ff053be07803344be1c395bfacf82dfcd0884801c38d49fc2e93a58dae5aadc2f61a36257bbe2e637ca496c15cbd0da428c594f
-
SSDEEP
12288:vdyAQva8aHoVM+LzndyAQva8aHoVM+LzxdyAQva8aHoVM+Lz:MilHoR0ilHoRWilHoR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03666516e7b3a4693b283e640b580a96_JaffaCakes118
Files
-
03666516e7b3a4693b283e640b580a96_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
8a05eb78589eb737f1150fdb0f20e9cc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
??2@YAPAXI@Z
floor
_aligned_free
_adjust_fdiv
_isnan
_except_handler3
_initterm
wcslen
_CIpow
_purecall
free
malloc
??3@YAXPAX@Z
_vsnwprintf
_aligned_malloc
_controlfp
kernel32
CreateEventW
ReleaseSemaphore
CreateSemaphoreW
HeapSize
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
GetLastError
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
GetTickCount
QueryPerformanceCounter
HeapFree
GetProcessHeap
InterlockedCompareExchange
GetCurrentThreadId
HeapAlloc
InitializeCriticalSection
DeleteCriticalSection
GetOverlappedResult
ReadFile
InterlockedExchange
WaitForMultipleObjects
CloseHandle
WaitForSingleObject
SetEvent
CreateThread
CreateEventA
Sleep
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetSystemInfo
LoadLibraryW
GetProcAddress
FreeLibrary
GetVersionExW
lstrcmpW
SetThreadPriority
SwitchToThread
QueryPerformanceFrequency
GetCurrentProcess
rpcrt4
RpcStringFreeA
UuidToStringA
ole32
PropVariantClear
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CLSIDFromString
advapi32
RegSetValueExA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
user32
GetDesktopWindow
winmm
timeEndPeriod
timeBeginPeriod
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 206KB - Virtual size: 205KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
RT_CODE Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ