D:\_Projects\ERRORSAFE120\China\ERRORSAFE_SCANNER_RELEASE\FixCore.pdb
Static task
static1
Behavioral task
behavioral1
Sample
04217375a6def8fc08e775cc942d3b1e_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
04217375a6def8fc08e775cc942d3b1e_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
04217375a6def8fc08e775cc942d3b1e_JaffaCakes118
-
Size
156KB
-
MD5
04217375a6def8fc08e775cc942d3b1e
-
SHA1
cc7819047eaef53715d70357ede42d15cd71fa4c
-
SHA256
b91beab66e971cbd6d783893130d77bf5cbaec77872a52289be64c94d620fddf
-
SHA512
f2d102daf6ae720913cece2399b004b7ba67633f77d77d78423203c4dd6f2396a2ef21715e6ee1238db46ea6450c8f8ef641e3e75ae9f8c3778a151b0fb33909
-
SSDEEP
3072:+q4IIX3Iz0UlinDiUNuZz4FlNTdEzFBt8+J0hSFrV2LIT:QUl3Y7XKzgS3t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04217375a6def8fc08e775cc942d3b1e_JaffaCakes118
Files
-
04217375a6def8fc08e775cc942d3b1e_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
ecde7204854e1b80094335eaed497c27
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
mfc71
ord765
ord315
ord1037
ord1206
ord1208
ord1098
ord371
ord1120
ord1175
ord1177
ord1209
ord1084
ord1092
ord1167
ord581
ord5437
ord1003
ord723
ord531
ord310
ord2322
ord432
ord762
ord1970
ord304
ord3997
ord876
ord578
ord1185
ord265
ord1917
ord266
ord314
ord1049
ord764
ord1187
ord1191
ord2248
ord3830
ord3683
ord757
ord566
ord3333
ord4261
ord4481
ord3949
ord2644
ord3709
ord3719
ord3718
ord2533
ord2646
ord2540
ord2838
ord2714
ord4307
ord2835
ord2731
ord2537
ord5566
ord5213
ord5230
ord4568
ord3948
ord5226
ord5224
ord2931
ord1920
ord3832
ord5382
ord6219
ord5102
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord1201
msvcr71
_strcmpi
memmove
malloc
free
_resetstkoflw
_except_handler3
__CxxFrameHandler
__CppXcptFilter
_adjust_fdiv
_initterm
wcsncpy
realloc
_CxxThrowException
atoi
wcscpy
memset
__security_error_handler
??1type_info@@UAE@XZ
_onexit
?terminate@@YAXXZ
__dllonexit
kernel32
GetTickCount
QueryPerformanceCounter
ExitProcess
LocalAlloc
LocalFree
GetStringTypeExW
GetStringTypeExA
GetEnvironmentVariableW
GetEnvironmentVariableA
CompareStringW
CompareStringA
lstrcmpiW
GetVersion
MoveFileA
SetFileAttributesA
DeleteFileA
FindFirstFileA
FindClose
ReadFile
CreateFileA
GetDriveTypeA
SetLastError
GetFileSize
SetEndOfFile
WriteFile
GetCurrentThreadId
SetFilePointer
GetModuleHandleA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
InterlockedDecrement
InterlockedIncrement
lstrcatA
GetModuleFileNameA
lstrcpyA
lstrcpynA
lstrcmpiA
lstrlenA
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetCurrentProcessId
GetSystemTimeAsFileTime
CloseHandle
IsDBCSLeadByte
user32
CharUpperA
CharLowerW
CharLowerA
CharUpperW
UnregisterClassA
CharNextA
advapi32
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
shlwapi
PathFindExtensionA
ole32
CoTaskMemFree
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
oleaut32
BSTR_UserSize
SysFreeString
BSTR_UserMarshal
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
SysStringLen
BSTR_UserFree
BSTR_UserUnmarshal
SysAllocString
rpcrt4
IUnknown_Release_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrStubForwardingFunction
NdrStubCall2
IUnknown_AddRef_Proxy
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 88KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ