msxml6.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0bac184f2c7a915e553a5f4b8cf69e7f_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0bac184f2c7a915e553a5f4b8cf69e7f_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0bac184f2c7a915e553a5f4b8cf69e7f_JaffaCakes118
-
Size
1.2MB
-
MD5
0bac184f2c7a915e553a5f4b8cf69e7f
-
SHA1
7b22d534f5d57c36baacff5d29a52beefa3b00f3
-
SHA256
d79618617ef92c3287fe7e17cf56b05ca67b3d3b61c824e0f018ba63e719aeb9
-
SHA512
e90f35e825456141c38eea30ab9b41d040f223c7a5d02f29d7e8df34eb720f6a0d746f3d8fbea995cffae38a100e07c2f548ff9963ed0ef6ad0cb0b388e5e5ab
-
SSDEEP
24576:EYOAcQUroER+ExBqdGwAMOmfuHAg+B8p3EzuK63ISvrOto3dKKnbrLv2cbk//QL9:XOAcFroEvxBqdht8T8usFci1X9s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0bac184f2c7a915e553a5f4b8cf69e7f_JaffaCakes118
Files
-
0bac184f2c7a915e553a5f4b8cf69e7f_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
3fcfd96fc572521bcbfc79514ef210af
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ole32
CoCreateFreeThreadedMarshaler
CreateBindCtx
CreateStreamOnHGlobal
StringFromCLSID
CLSIDFromProgID
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
shlwapi
StrCmpNW
PathIsURLW
PathSearchAndQualifyW
UrlCreateFromPathW
PathCreateFromUrlW
UrlCanonicalizeW
UrlUnescapeW
PathIsRelativeW
UrlIsW
UrlGetLocationW
StrCmpNIW
StrToIntW
StrCmpW
kernel32
CreateFileW
DebugBreak
LocalAlloc
LocalFree
ReadFile
SetEndOfFile
TlsGetValue
GetLastError
OutputDebugStringW
InterlockedIncrement
InterlockedDecrement
ExpandEnvironmentStringsW
GetModuleFileNameW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
HeapFree
GetProcessHeap
InterlockedCompareExchange
CloseHandle
TlsSetValue
DuplicateHandle
GetCurrentThread
GetVersionExW
TlsAlloc
TlsFree
InitializeCriticalSection
WaitForSingleObject
ReleaseSemaphore
InterlockedExchange
CreateSemaphoreW
CreateEventW
Sleep
InterlockedExchangeAdd
TryEnterCriticalSection
VirtualQuery
GetThreadContext
ResumeThread
SuspendThread
SetEvent
ResetEvent
VirtualAlloc
VirtualFree
HeapDestroy
HeapCreate
GetProcAddress
GetModuleHandleW
SetLastError
GetSystemInfo
RaiseException
MultiByteToWideChar
FreeLibrary
FormatMessageW
LoadLibraryExW
LoadLibraryW
LoadResource
FindResourceW
SizeofResource
LockResource
FileTimeToSystemTime
SystemTimeToFileTime
GetThreadLocale
GetTimeFormatW
GetDateFormatW
CompareStringW
GetCommandLineA
GetVersionExA
VirtualProtect
RtlUnwind
ExitProcess
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
WriteFile
HeapReAlloc
HeapSize
GetACP
GetOEMCP
GetCPInfo
LoadLibraryA
GetStringTypeA
GetStringTypeW
SetFilePointer
GetUserDefaultLCID
GetLocaleInfoA
LCMapStringA
LCMapStringW
SetStdHandle
FlushFileBuffers
advapi32
OpenThreadToken
RevertToSelf
SetThreadToken
RegEnumValueW
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteValueW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllSetProperty
DllUnregisterServer
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 48KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 129KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ