g:\project\cadi\Src\CTPresetW\Release\CtPresetW.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0381e32e59a324347891df5d468195de_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0381e32e59a324347891df5d468195de_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0381e32e59a324347891df5d468195de_JaffaCakes118
-
Size
380KB
-
MD5
0381e32e59a324347891df5d468195de
-
SHA1
4462ef2051616cdfa801a65f92745edbcf4c83a5
-
SHA256
c6a859aa4797af8a6779e105d395aa77a6bf64b08e96c11c011fe11301ff470b
-
SHA512
2108d2800de567717c26a9ba865d7b9e025595774afc5da58080c5104a996f6d95eae28f0d05669d0161a7e47bda3d6ee3fd86a0b0c655af8ecfa6eef8de0562
-
SSDEEP
3072:hfJ2Miokl+TI4u38zAuNfgrDy7JTj5PVaBp70cibwCAz1tdevWAg0FuQPZy73581:V1gCK9qfgrDyJ/spZibdAzBAOL8D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0381e32e59a324347891df5d468195de_JaffaCakes118
Files
-
0381e32e59a324347891df5d468195de_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
41d042b847ecb06ed1b92806b0dc5e47
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
lstrlenA
SetThreadLocale
GetThreadLocale
GetProcAddress
LoadLibraryW
GetVersionExA
LeaveCriticalSection
GetACP
GetLocaleInfoA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
CreateFileA
EnterCriticalSection
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
FreeLibrary
lstrcmpiW
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetModuleFileNameW
GetLastError
CopyFileW
InterlockedExchange
lstrlenW
ReadFile
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetStringTypeW
GetStringTypeA
LoadLibraryA
RtlUnwind
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
CloseHandle
GetModuleHandleA
VirtualFree
VirtualAlloc
HeapCreate
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCPInfo
GetOEMCP
LCMapStringA
WideCharToMultiByte
LCMapStringW
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
CreateFileW
user32
UnregisterClassA
CharNextW
advapi32
RegCreateKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyW
RegEnumKeyW
RegQueryValueExW
RegCloseKey
SetNamedSecurityInfoW
ole32
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
shell32
SHGetFolderPathW
SHCreateDirectoryExW
oleaut32
UnRegisterTypeLi
SysAllocString
LoadTypeLi
LoadRegTypeLi
SysStringLen
VarUI4FromStr
SysFreeString
RegisterTypeLi
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 248KB - Virtual size: 247KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 64KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ