crypt32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
7bb3fe507d7143cd54293da3fb5df3ab_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
7bb3fe507d7143cd54293da3fb5df3ab_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
7bb3fe507d7143cd54293da3fb5df3ab_JaffaCakes118
-
Size
1.5MB
-
MD5
7bb3fe507d7143cd54293da3fb5df3ab
-
SHA1
c31c241a5f2f17daefba80735637466181e2c488
-
SHA256
c919dad8338a0ff78e0386735e81c4a9408d740475e0f286d8724bf86df2b72d
-
SHA512
b8881afad93b285d76646bf592b35a7cdfee839241c1265b8a0f74398357c1bfb9a8f8232887ad36ab4efef8e4c11b8963e0a6a94b8c8ea9b350ddd433a7fb54
-
SSDEEP
24576:myfoq3TrB2q0HmSBJ8s5doey/YuBjvtVZc/xY5ol+FJxj0:myQqBAxBbQpxjvtViCJxj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7bb3fe507d7143cd54293da3fb5df3ab_JaffaCakes118
Files
-
7bb3fe507d7143cd54293da3fb5df3ab_JaffaCakes118.dll windows:6 windows x86 arch:x86
9bf79e32bd212b136bdd2650aefad3ae
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_unlock
__dllonexit
atol
_except_handler4_common
_lock
_initterm
malloc
free
_amsg_exit
_XcptFilter
_onexit
memset
memcpy
qsort_s
_itoa_s
iswalnum
iswspace
toupper
wcsrchr
_ultoa_s
_wcsicmp
_ultow_s
_itow
wcsstr
wcschr
wcstoul
iswalpha
memmove
_ltow
_vsnwprintf
strncmp
_vsnprintf
isdigit
isupper
isxdigit
qsort
bsearch
_ltoa
strtoul
memcmp
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegGetKeySecurity
RegEnumValueW
RegSetValueExW
RegSetKeySecurity
RegOpenKeyExW
RegSetValueExA
RegCreateKeyExW
RegOpenKeyExA
RegNotifyChangeKeyValue
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExW
RegLoadMUIStringW
RegEnumKeyExW
RegEnumKeyExA
RegDeleteKeyExW
api-ms-win-core-synch-l1-2-0
WaitForMultipleObjectsEx
LeaveCriticalSection
WaitForSingleObjectEx
CreateEventA
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
DeleteCriticalSection
Sleep
InitializeSRWLock
InitializeCriticalSection
SetEvent
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
api-ms-win-core-processenvironment-l1-2-0
GetEnvironmentVariableA
GetCommandLineA
ExpandEnvironmentStringsW
api-ms-win-core-errorhandling-l1-1-1
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-interlocked-l1-2-0
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
api-ms-win-core-processthreads-l1-1-1
OpenThreadToken
SetThreadStackGuarantee
OpenProcessToken
CreateThread
GetCurrentThreadId
GetCurrentThread
TlsFree
ExitThread
TlsSetValue
GetCurrentProcess
TlsAlloc
GetCurrentProcessId
TerminateProcess
SetThreadToken
TlsGetValue
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-2-0
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount64
GetSystemTime
GetVersionExA
GetLocalTime
GetTickCount
GetWindowsDirectoryW
api-ms-win-core-file-l1-2-0
CreateFileW
DeleteFileW
FindFirstFileW
FindClose
FindNextChangeNotification
FindCloseChangeNotification
FindFirstChangeNotificationW
SetFileAttributesW
CreateDirectoryW
FindNextFileW
CreateFileA
GetFileAttributesExW
FileTimeToLocalFileTime
WriteFile
GetFileAttributesW
ReadFile
SetFilePointer
CompareFileTime
GetTempPathW
GetTempFileNameW
SetEndOfFile
GetFileSize
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
api-ms-win-security-base-l1-2-0
GetSecurityDescriptorDacl
GetSecurityDescriptorOwner
AccessCheck
ImpersonateSelf
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetAce
SetSecurityDescriptorGroup
EqualSid
MakeSelfRelativeSD
GetSecurityDescriptorSacl
InitializeAcl
GetAclInformation
AddAccessAllowedAceEx
AddAce
GetFileSecurityW
GetLengthSid
IsValidSid
CopySid
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
SetFileSecurityW
AdjustTokenPrivileges
MakeAbsoluteSD
SetSecurityDescriptorDacl
CheckTokenCapability
AddAccessAllowedAce
RevertToSelf
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-localization-l1-2-0
IdnToAscii
IdnToUnicode
FormatMessageW
GetACP
api-ms-win-core-debug-l1-1-1
OutputDebugStringA
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-libraryloader-l1-1-1
GetProcAddress
FreeResource
LoadResource
SizeofResource
LockResource
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
FreeLibraryAndExitThread
LoadStringW
FreeLibrary
api-ms-win-core-datetime-l1-1-1
GetDateFormatW
GetTimeFormatA
GetDateFormatA
GetTimeFormatW
api-ms-win-core-memory-l1-1-1
VirtualQuery
VirtualAlloc
MapViewOfFile
UnmapViewOfFile
VirtualProtect
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-version-l1-1-0
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
LocalSize
LocalReAlloc
LocalAlloc
api-ms-win-core-localization-obsolete-l1-1-0
CompareStringA
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
api-ms-win-core-string-obsolete-l1-1-0
lstrlenW
lstrlenA
lstrcmpA
lstrcmpiW
api-ms-win-core-threadpool-legacy-l1-1-0
UnregisterWaitEx
api-ms-win-core-kernel32-legacy-l1-1-0
FindResourceExA
GetComputerNameW
LoadLibraryA
CreateFileMappingA
api-ms-win-core-threadpool-private-l1-1-0
RegisterWaitForSingleObjectEx
api-ms-win-security-grouppolicy-l1-1-0
UnregisterGPNotificationInternal
RegisterGPNotificationInternal
api-ms-win-core-wow64-l1-1-0
IsWow64Process
msasn1
ASN1_FreeDecoded
ASN1DEREncEndBlk
ASN1DEREncNewBlkElement
ASN1BERDecEoid
ASN1EncSetError
ASN1BERDecZeroCharString
ASN1_SetEncoderOption
ASN1_Decode
ASN1_Encode
ASN1objectidentifier2_cmp
ASN1_FreeEncoded
ASN1_CloseEncoder
ASN1_CloseDecoder
ASN1BERDecObjectIdentifier2
ASN1BEREncObjectIdentifier2
ASN1_CreateEncoder
ASN1_CreateDecoder
ASN1BEREoid2DotVal
ASN1Free
ASN1BERDotVal2Eoid
ASN1BERDecOctetString
ASN1BEREncBool
ASN1_CreateModule
ASN1octetstring_free
ASN1BEREncExplicitTag
ASN1DEREncOctetString
ASN1open_free
ASN1BERDecExplicitTag
ASN1BERDecMultibyteString
ASN1BERDecNotEndOfContents
ASN1BERDecNull
ASN1DEREncBeginBlk
ASN1DEREncCharString
ASN1BERDecGeneralizedTime
ASN1DEREncMultibyteString
ASN1BEREncEoid
ASN1BERDecOpenType
ASN1BEREncU32
ASN1DEREncUTCTime
ASN1DEREncChar32String
ASN1BERDecChar32String
ASN1BEREncOpenType
ASN1BERDecCharString
ASN1BERDecBitString2
ASN1intx_free
ASN1DEREncChar16String
ASN1charstring_free
ASN1BEREoid_free
ASN1DEREncUTF8String
ASN1_CloseModule
ASN1DEREncGeneralizedTime
ASN1BERDecEndOfContents
ASN1utf8string_free
ASN1BERDecUTCTime
ASN1BERDecBool
ASN1BERDecSXVal
ASN1DecSetError
ASN1DEREncBitString
ASN1BERDecOctetString2
ASN1char32string_free
ASN1DEREncFlushBlkElement
ASN1BERDecU32Val
ASN1ztcharstring_free
ASN1BERDecS32Val
ASN1BERDecU16Val
ASN1BERDecChar16String
ASN1BERDecUTF8String
ASN1BERDecPeekTag
ASN1BEREncNull
ASN1BEREncSX
ASN1DecRealloc
ASN1BERDecBitString
ASN1bitstring_free
ASN1BERDecOpenType2
ASN1BEREncRemoveZeroBits
ASN1BEREncS32
ASN1BEREncEndOfContents
ASN1char16string_free
ntdll
RtlImageNtHeader
RtlAllocateHeap
RtlFreeHeap
NtQueryInformationFile
EtwEventWriteFull
WinSqmIncrementDWORD
EtwEventUnregister
EvtIntReportEventAndSourceAsync
EtwEventRegister
RtlNtStatusToDosError
RtlFreeUnicodeString
RtlCreateUnicodeStringFromAsciiz
RtlIpv6StringToAddressExW
RtlIpv4StringToAddressExW
RtlPrefixUnicodeString
RtlInitUnicodeString
NtQueryObject
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
ShipAssert
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
DelayLoadFailureHook
Exports
Exports
CertAddCRLContextToStore
CertAddCRLLinkToStore
CertAddCTLContextToStore
CertAddCTLLinkToStore
CertAddCertificateContextToStore
CertAddCertificateLinkToStore
CertAddEncodedCRLToStore
CertAddEncodedCTLToStore
CertAddEncodedCertificateToStore
CertAddEncodedCertificateToSystemStoreA
CertAddEncodedCertificateToSystemStoreW
CertAddEnhancedKeyUsageIdentifier
CertAddRefServerOcspResponse
CertAddRefServerOcspResponseContext
CertAddSerializedElementToStore
CertAddStoreToCollection
CertAlgIdToOID
CertCloseServerOcspResponse
CertCloseStore
CertCompareCertificate
CertCompareCertificateName
CertCompareIntegerBlob
CertComparePublicKeyInfo
CertControlStore
CertCreateCRLContext
CertCreateCTLContext
CertCreateCTLEntryFromCertificateContextProperties
CertCreateCertificateChainEngine
CertCreateCertificateContext
CertCreateContext
CertCreateSelfSignCertificate
CertDeleteCRLFromStore
CertDeleteCTLFromStore
CertDeleteCertificateFromStore
CertDuplicateCRLContext
CertDuplicateCTLContext
CertDuplicateCertificateChain
CertDuplicateCertificateContext
CertDuplicateStore
CertEnumCRLContextProperties
CertEnumCRLsInStore
CertEnumCTLContextProperties
CertEnumCTLsInStore
CertEnumCertificateContextProperties
CertEnumCertificatesInStore
CertEnumPhysicalStore
CertEnumSubjectInSortedCTL
CertEnumSystemStore
CertEnumSystemStoreLocation
CertFindAttribute
CertFindCRLInStore
CertFindCTLInStore
CertFindCertificateInCRL
CertFindCertificateInStore
CertFindChainInStore
CertFindExtension
CertFindRDNAttr
CertFindSubjectInCTL
CertFindSubjectInSortedCTL
CertFreeCRLContext
CertFreeCTLContext
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateChainList
CertFreeCertificateContext
CertFreeServerOcspResponseContext
CertGetCRLContextProperty
CertGetCRLFromStore
CertGetCTLContextProperty
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertGetIssuerCertificateFromStore
CertGetNameStringA
CertGetNameStringW
CertGetPublicKeyLength
CertGetServerOcspResponseContext
CertGetStoreProperty
CertGetSubjectCertificateFromStore
CertGetValidUsages
CertIsRDNAttrsInCertificateName
CertIsStrongHashToSign
CertIsValidCRLForCertificate
CertNameToStrA
CertNameToStrW
CertOIDToAlgId
CertOpenServerOcspResponse
CertOpenStore
CertOpenSystemStoreA
CertOpenSystemStoreW
CertRDNValueToStrA
CertRDNValueToStrW
CertRegisterPhysicalStore
CertRegisterSystemStore
CertRemoveEnhancedKeyUsageIdentifier
CertRemoveStoreFromCollection
CertResyncCertificateChainEngine
CertRetrieveLogoOrBiometricInfo
CertSaveStore
CertSelectCertificateChains
CertSerializeCRLStoreElement
CertSerializeCTLStoreElement
CertSerializeCertificateStoreElement
CertSetCRLContextProperty
CertSetCTLContextProperty
CertSetCertificateContextPropertiesFromCTLEntry
CertSetCertificateContextProperty
CertSetEnhancedKeyUsage
CertSetStoreProperty
CertStrToNameA
CertStrToNameW
CertUnregisterPhysicalStore
CertUnregisterSystemStore
CertVerifyCRLRevocation
CertVerifyCRLTimeValidity
CertVerifyCTLUsage
CertVerifyCertificateChainPolicy
CertVerifyRevocation
CertVerifySubjectCertificateContext
CertVerifyTimeValidity
CertVerifyValidityNesting
CreateFileU
CryptAcquireCertificatePrivateKey
CryptAcquireContextU
CryptBinaryToStringA
CryptBinaryToStringW
CryptCloseAsyncHandle
CryptCreateAsyncHandle
CryptCreateKeyIdentifierFromCSP
CryptDecodeMessage
CryptDecodeObject
CryptDecodeObjectEx
CryptDecryptAndVerifyMessageSignature
CryptDecryptMessage
CryptEncodeObject
CryptEncodeObjectEx
CryptEncryptMessage
CryptEnumKeyIdentifierProperties
CryptEnumOIDFunction
CryptEnumOIDInfo
CryptEnumProvidersU
CryptExportPKCS8
CryptExportPublicKeyInfo
CryptExportPublicKeyInfoEx
CryptExportPublicKeyInfoFromBCryptKeyHandle
CryptFindCertificateKeyProvInfo
CryptFindLocalizedName
CryptFindOIDInfo
CryptFormatObject
CryptFreeOIDFunctionAddress
CryptGetAsyncParam
CryptGetDefaultOIDDllList
CryptGetDefaultOIDFunctionAddress
CryptGetKeyIdentifierProperty
CryptGetMessageCertificates
CryptGetMessageSignerCount
CryptGetOIDFunctionAddress
CryptGetOIDFunctionValue
CryptHashCertificate
CryptHashCertificate2
CryptHashMessage
CryptHashPublicKeyInfo
CryptHashToBeSigned
CryptImportPKCS8
CryptImportPublicKeyInfo
CryptImportPublicKeyInfoEx
CryptImportPublicKeyInfoEx2
CryptInitOIDFunctionSet
CryptInstallDefaultContext
CryptInstallOIDFunctionAddress
CryptLoadSip
CryptMemAlloc
CryptMemFree
CryptMemRealloc
CryptMsgCalculateEncodedLength
CryptMsgClose
CryptMsgControl
CryptMsgCountersign
CryptMsgCountersignEncoded
CryptMsgDuplicate
CryptMsgEncodeAndSignCTL
CryptMsgGetAndVerifySigner
CryptMsgGetParam
CryptMsgOpenToDecode
CryptMsgOpenToEncode
CryptMsgSignCTL
CryptMsgUpdate
CryptMsgVerifyCountersignatureEncoded
CryptMsgVerifyCountersignatureEncodedEx
CryptObjectLocatorFree
CryptObjectLocatorGet
CryptObjectLocatorGetContent
CryptObjectLocatorGetUpdated
CryptObjectLocatorInitialize
CryptObjectLocatorIsChanged
CryptObjectLocatorRelease
CryptProtectData
CryptProtectMemory
CryptQueryObject
CryptRegisterDefaultOIDFunction
CryptRegisterOIDFunction
CryptRegisterOIDInfo
CryptRetrieveTimeStamp
CryptSIPAddProvider
CryptSIPCreateIndirectData
CryptSIPGetCaps
CryptSIPGetSignedDataMsg
CryptSIPLoad
CryptSIPPutSignedDataMsg
CryptSIPRemoveProvider
CryptSIPRemoveSignedDataMsg
CryptSIPRetrieveSubjectGuid
CryptSIPRetrieveSubjectGuidForCatalogFile
CryptSIPVerifyIndirectData
CryptSetAsyncParam
CryptSetKeyIdentifierProperty
CryptSetOIDFunctionValue
CryptSetProviderU
CryptSignAndEncodeCertificate
CryptSignAndEncryptMessage
CryptSignCertificate
CryptSignHashU
CryptSignMessage
CryptSignMessageWithKey
CryptStringToBinaryA
CryptStringToBinaryW
CryptUninstallDefaultContext
CryptUnprotectData
CryptUnprotectMemory
CryptUnregisterDefaultOIDFunction
CryptUnregisterOIDFunction
CryptUnregisterOIDInfo
CryptUpdateProtectedState
CryptVerifyCertificateSignature
CryptVerifyCertificateSignatureEx
CryptVerifyDetachedMessageHash
CryptVerifyDetachedMessageSignature
CryptVerifyMessageHash
CryptVerifyMessageSignature
CryptVerifyMessageSignatureWithKey
CryptVerifySignatureU
CryptVerifyTimeStampSignature
I_CertDiagControl
I_CertProtectFunction
I_CertSrvProtectFunction
I_CertSyncStore
I_CertUpdateStore
I_CryptAddRefLruEntry
I_CryptAddSmartCardCertToStore
I_CryptAllocTls
I_CryptCreateLruCache
I_CryptCreateLruEntry
I_CryptDetachTls
I_CryptDisableLruOfEntries
I_CryptEnableLruOfEntries
I_CryptEnumMatchingLruEntries
I_CryptFindLruEntry
I_CryptFindLruEntryData
I_CryptFindSmartCardCertInStore
I_CryptFlushLruCache
I_CryptFreeLruCache
I_CryptFreeTls
I_CryptGetAsn1Decoder
I_CryptGetAsn1Encoder
I_CryptGetDefaultCryptProv
I_CryptGetDefaultCryptProvForEncrypt
I_CryptGetFileVersion
I_CryptGetLruEntryData
I_CryptGetLruEntryIdentifier
I_CryptGetOssGlobal
I_CryptGetTls
I_CryptInsertLruEntry
I_CryptInstallAsn1Module
I_CryptInstallOssGlobal
I_CryptReadTrustedPublisherDWORDValueFromRegistry
I_CryptRegisterSmartCardStore
I_CryptReleaseLruEntry
I_CryptRemoveLruEntry
I_CryptSetTls
I_CryptTouchLruEntry
I_CryptUninstallAsn1Module
I_CryptUninstallOssGlobal
I_CryptUnregisterSmartCardStore
I_CryptWalkAllLruCacheEntries
PFXExportCertStore
PFXExportCertStore2
PFXExportCertStoreEx
PFXImportCertStore
PFXIsPFXBlob
PFXVerifyPassword
RegCreateHKCUKeyExU
RegCreateKeyExU
RegDeleteValueU
RegEnumValueU
RegOpenHKCUKeyExU
RegOpenKeyExU
RegQueryInfoKeyU
RegQueryValueExU
RegSetValueExU
Sections
.text Size: 934KB - Virtual size: 933KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 553KB - Virtual size: 553KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ