ICWUTIL.pdb
Static task
static1
Behavioral task
behavioral1
Sample
084335b05c438b730147b7e9b2b4fca7_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
084335b05c438b730147b7e9b2b4fca7_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
084335b05c438b730147b7e9b2b4fca7_JaffaCakes118
-
Size
100KB
-
MD5
084335b05c438b730147b7e9b2b4fca7
-
SHA1
7cd2a0660adeb35acdeef4302e6465e075a03a81
-
SHA256
4c0d44d4d8a5683218c8bea0a8c04cc7f8fed380ce8824efc8b0a84af972201d
-
SHA512
e088e782bed8eda7cdd195311ee51e470df0611232d86dc4507eb72d950dbfe8eadade8f6c6d109425e68e358bd953ddf410e2e70e82b77680e03eedf09c0720
-
SSDEEP
1536:8qc+5uxyr/D3FMrdn2A/mrsLWm8vgYeqmLO0yzmP5B9JxSodb476Bv:Rrb3FAnCrPvgYeq63Ruol476B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 084335b05c438b730147b7e9b2b4fca7_JaffaCakes118
Files
-
084335b05c438b730147b7e9b2b4fca7_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
6593bb0cd6aa5ba6d1ec0e65a400cca7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_adjust_fdiv
_initterm
wcschr
_wcsdup
wcstok
_wtoi
_wtol
malloc
??2@YAPAXI@Z
wcslen
??3@YAXPAX@Z
free
kernel32
GetTempFileNameW
GetTempPathW
lstrcatW
lstrcpyW
lstrlenW
GetModuleFileNameW
SetEvent
lstrcpynW
CreateEventW
lstrcmpiW
CopyFileW
GetUserDefaultLCID
GetLocalTime
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalAlloc
LocalAlloc
WriteFile
CreateFileW
LocalFree
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DeleteFileW
CompareStringW
InterlockedDecrement
InterlockedIncrement
CloseHandle
user32
MsgWaitForMultipleObjects
WaitMessage
ReleaseDC
GetDC
CreateIconIndirect
CharNextW
CharPrevW
TranslateMessage
IsRectEmpty
PostMessageW
LoadStringW
wsprintfW
CopyRect
GetClientRect
DispatchMessageW
PeekMessageW
GetWindowLongW
RegisterClassExW
DefWindowProcW
GetKeyState
SetWindowLongW
MessageBoxW
GetParent
gdi32
SetBkColor
CreateCompatibleBitmap
CreateCompatibleDC
CreateBitmap
GetObjectW
GetDIBits
GetDeviceCaps
BitBlt
PatBlt
SelectObject
CreateSolidBrush
DeleteDC
DeleteObject
advapi32
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
ole32
StringFromCLSID
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
StgCreateDocfile
OleSetContainedObject
OleCreate
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
RegisterServer
URLAppendQueryPair
URLEncode
UnregisterServer
Sections
.text Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ