rrcm.pdb
Static task
static1
Behavioral task
behavioral1
Sample
eca303e9688ab4f69e7aab639e439f6c_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
eca303e9688ab4f69e7aab639e439f6c_JaffaCakes118
-
Size
156KB
-
MD5
eca303e9688ab4f69e7aab639e439f6c
-
SHA1
23e3353c64c7b5cb16a9d36beeb6003cf50a92d7
-
SHA256
01ad733d2e326c07d5df88e0d6fa00936c6c9187d0afcdc8d301c1987bbc63cf
-
SHA512
60952c60302c00c9f974c0db44055ec15afd1e126f8c59ca3ab68fc3577dfae2a0e8a5d1fdfb1c5b5ba94003e46960e808f0634fbaa9b39b29c86f984b0b71f9
-
SSDEEP
3072:+8BWeTEtn8SmXlcPpRujQG6AeHfT78SnNpWC4JuwqQ0wc:+kotn8SmXlGqQG6J0S74Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eca303e9688ab4f69e7aab639e439f6c_JaffaCakes118
Files
-
eca303e9688ab4f69e7aab639e439f6c_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
bc195581374f43a7c4742a5f2571ae06
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
free
realloc
_initterm
_adjust_fdiv
malloc
winmm
timeGetTime
kernel32
lstrlenW
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrlenA
lstrcmpiA
IsDBCSLeadByte
lstrcpynA
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
lstrcpyA
lstrcatA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
DisableThreadLibraryCalls
SizeofResource
LoadResource
FindResourceA
GetLastError
LoadLibraryExA
WideCharToMultiByte
GlobalFree
LocalFree
LocalAlloc
GlobalAlloc
GetTickCount
SleepEx
Sleep
GetComputerNameA
CloseHandle
WaitForSingleObject
SetEvent
QueueUserAPC
DuplicateHandle
GetCurrentThread
GetCurrentProcess
GetCurrentThreadId
GetModuleHandleA
CreateThread
CreateEventA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
MultiByteToWideChar
HeapFree
TerminateThread
GetProcessTimes
HeapCreate
ExitThread
WaitForMultipleObjectsEx
SuspendThread
ResumeThread
GetShortPathNameA
HeapAlloc
advapi32
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
GetUserNameA
RegQueryValueExA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
user32
UnregisterClassA
RegisterClassA
CreateWindowExA
PeekMessageA
CharNextA
PostMessageA
DefWindowProcA
PostQuitMessage
GetMessageA
DispatchMessageA
TranslateMessage
wsock32
recvfrom
htons
WSAGetLastError
ntohs
htonl
ntohl
WSAAsyncSelect
socket
setsockopt
bind
getsockname
gethostname
gethostbyname
closesocket
WSASetLastError
sendto
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
oleaut32
SysFreeString
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
SysAllocString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
RTCPReportRequest
getRtcpSessionList
Sections
.text Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ