wmpdxm.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0742653b595c6e150e1d7d76cb34ce57_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0742653b595c6e150e1d7d76cb34ce57_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0742653b595c6e150e1d7d76cb34ce57_JaffaCakes118
-
Size
288KB
-
MD5
0742653b595c6e150e1d7d76cb34ce57
-
SHA1
7e3859cfce827fbf345891fa6f4761011852fa70
-
SHA256
145657c4d832831dd4e6ad5106100fecee3681a072d93a427385d4b1d2110d37
-
SHA512
3d11b49ce87ae44265c3676a448ec837c968165e28406f6c8d313f2a1018be1956f23a8942c0c831d2747aabc86b8715b12d07a014d4b2088f70a99fd8cd4b41
-
SSDEEP
6144:v63iUizlwL9k6xXxGwWAkxlXKVnAcxLZhGEuDAg:vimwL9kokwWAf26g
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0742653b595c6e150e1d7d76cb34ce57_JaffaCakes118
Files
-
0742653b595c6e150e1d7d76cb34ce57_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
72d97f46831a387043cd566f7fcb7a30
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetLocalTime
GlobalMemoryStatus
GetDiskFreeSpaceA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetCurrentProcessId
GetCurrentThreadId
LoadLibraryA
GetTickCount
QueryPerformanceCounter
RaiseException
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
lstrlenA
lstrcatW
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameW
lstrcpynW
GetModuleHandleW
LoadLibraryW
GetProcAddress
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
lstrcpyW
lstrlenW
MultiByteToWideChar
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
GetVersionExW
GetLastError
Sleep
CompareStringW
WideCharToMultiByte
CloseHandle
GetDriveTypeW
CreateFileW
DeviceIoControl
CreateFileA
GetVersion
QueryDosDeviceW
SetErrorMode
GetWindowsDirectoryW
SetLastError
GetExitCodeThread
WaitForSingleObject
GetFileAttributesW
GetTimeFormatW
GetNumberFormatW
GetLocaleInfoW
GetVersionExA
HeapFree
HeapAlloc
GetProcessHeap
msvcrt
_initterm
_adjust_fdiv
__dllonexit
_onexit
wcspbrk
wcschr
wcsstr
free
??3@YAXPAX@Z
realloc
wcsrchr
wcsncmp
_wcsnicmp
_beginthreadex
_wtol
_CIpow
_purecall
??2@YAPAXI@Z
memmove
towupper
wcsncpy
_snwprintf
_except_handler3
_wcsicmp
wcscmp
iswdigit
_wtoi
wcslen
_vsnwprintf
iswspace
malloc
gdi32
GetDeviceCaps
user32
CharNextA
CharPrevW
ReleaseDC
CharNextW
GetDC
advapi32
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyExA
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExA
RegSetValueExA
ole32
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
oleaut32
LoadRegTypeLi
VariantInit
SysAllocString
SysFreeString
LoadTypeLi
RegisterTypeLi
SysStringLen
VarUI4FromStr
VariantClear
VariantChangeType
SysAllocStringLen
mpr
WNetCancelConnection2W
WNetAddConnection2W
WNetGetConnectionW
shlwapi
PathGetCharTypeW
PathGetCharTypeA
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 220KB - Virtual size: 219KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ