g:\Acro_root_vg\Viewer\Win\PDFShell\Release\PDFShell.pdb
Static task
static1
Behavioral task
behavioral1
Sample
03b27df25d27ffd7814be4a8f162933d_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
03b27df25d27ffd7814be4a8f162933d_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
03b27df25d27ffd7814be4a8f162933d_JaffaCakes118
-
Size
164KB
-
MD5
03b27df25d27ffd7814be4a8f162933d
-
SHA1
e14e64ec60008bca233fe6c26ecd2ef28006247e
-
SHA256
bcf413b443291d75d3f88c192216ccbafcb9825dd7f7f6c98b14df2bb5975056
-
SHA512
0cbc55b08dfd5462606a1f5e6cd5d4c9676cdcd00c715948ef7798a6b019b478989848e794821c33e6a1673a88a98bb1f4f83f1cf4c9e1759d70fc18c96d333a
-
SSDEEP
3072:wMWsA+a5BH3fZkjlHhM5g5vPOe634cgegDZeoVxAJgEV:fVA+C3SxH5vPpC4x0oVK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03b27df25d27ffd7814be4a8f162933d_JaffaCakes118
Files
-
03b27df25d27ffd7814be4a8f162933d_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
0a7ecb1ad2d1388dcba80d3857d925d7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
shlwapi
PathFindExtensionA
PathRenameExtensionA
kernel32
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrlenA
lstrcmpiA
LoadLibraryW
SetLastError
GetModuleFileNameW
OutputDebugStringA
DisableThreadLibraryCalls
LoadLibraryExA
InterlockedIncrement
InterlockedDecrement
lstrcpynA
lstrcpyA
GetModuleFileNameA
lstrcatA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
lstrcpyW
GetThreadLocale
LocalFree
FileTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LoadLibraryA
GetTimeFormatA
GetDateFormatA
LocalAlloc
GetUserDefaultLangID
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetCPInfo
GetOEMCP
IsBadCodePtr
IsBadReadPtr
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
GetLocaleInfoA
InterlockedExchange
GetACP
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
lstrcmpiW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
HeapSize
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetCurrentProcess
TerminateProcess
IsBadWritePtr
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
ExitProcess
RtlUnwind
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
HeapDestroy
HeapCreate
VirtualFree
user32
MapWindowPoints
CharNextA
LoadStringW
SetWindowLongA
GetWindowLongA
GetActiveWindow
MessageBoxA
GetParent
SetDlgItemTextW
GetDlgItem
GetWindowRect
GetWindowTextA
SendMessageA
SetWindowPos
GetDlgItemTextW
LoadStringA
SetDlgItemTextA
wsprintfA
gdi32
GdiFlush
CreateDIBSection
advapi32
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
shell32
DragQueryFileW
ole32
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
StringFromGUID2
oleaut32
SysStringLen
SysStringByteLen
VariantClear
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ