admparse.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0c8ed8c71229115120ef2c93a48f543c_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0c8ed8c71229115120ef2c93a48f543c_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0c8ed8c71229115120ef2c93a48f543c_JaffaCakes118
-
Size
60KB
-
MD5
0c8ed8c71229115120ef2c93a48f543c
-
SHA1
5860f7e31f43f89072507ae8a6b6a8db85ac28a4
-
SHA256
d5d7aa00db06955279c24e5cd760452dcc5c8767bab216c17c88ded75a00c90c
-
SHA512
5faded2d7a9f1657d9b509d15aa50724011dd24b51b91420a231bfeffdd1fda21f1d6b4ae9ad2565c2cdb8da46e3feba270c17d2ea7e7997efd08d3445bb5fd3
-
SSDEEP
1536:iUtu2nTL+4XtcFhDpeFiZ6uxWjJ6ka6zoLL1qFZVFI:iUtu2TL+KtcFh6IWjk6zoLL1SZVO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c8ed8c71229115120ef2c93a48f543c_JaffaCakes118
Files
-
0c8ed8c71229115120ef2c93a48f543c_JaffaCakes118.dll windows:5 windows x86 arch:x86
f3ac3066b9731a5fe8b7560b232a1a7e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
?terminate@@YAXXZ
_CxxThrowException
_vsnwprintf
??1type_info@@UAE@XZ
_adjust_fdiv
_except_handler3
??3@YAXPAX@Z
??2@YAPAXI@Z
free
malloc
_initterm
kernel32
LeaveCriticalSection
EnterCriticalSection
GlobalAlloc
AddAtomA
WriteFile
SetFilePointer
lstrlenA
lstrcpyW
lstrcmpiW
CompareStringW
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
SetLastError
UnhandledExceptionFilter
GlobalFree
GetFileSize
GetLastError
LocalAlloc
CloseHandle
HeapAlloc
HeapReAlloc
lstrlenW
LocalFree
GetProcessHeap
HeapFree
ReadFile
InitializeCriticalSection
FindAtomA
DeleteAtom
SetUnhandledExceptionFilter
DeleteCriticalSection
WritePrivateProfileSectionW
WritePrivateProfileSectionA
GetPrivateProfileSectionW
GetPrivateProfileSectionA
GetPrivateProfileStringA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
user32
UnregisterClassA
ShowWindow
SetScrollRange
GetClientRect
SetScrollPos
CreateWindowExA
RegisterClassA
DestroyWindow
GetWindowRect
GetParent
MoveWindow
ReleaseDC
GetDC
EndDialog
EnableWindow
GetDlgItem
SetWindowPos
GetScrollInfo
gdi32
DeleteObject
GetDeviceCaps
GetStockObject
SelectObject
shlwapi
ord340
ord74
ord37
ord59
ord55
ord61
ord91
ord138
ord143
ord93
ord53
ord136
ord95
StrCatW
ord102
ord94
ord56
ord141
ord107
StrRChrW
wnsprintfW
ord298
ord52
StrToIntW
StrDupW
StrCmpNW
StrCpyW
StrCmpW
StrCmpIW
StrSpnW
StrCSpnW
StrCpyNW
ord75
ord217
ord215
ord68
ord295
PathFindFileNameW
ord312
ord437
oleaut32
SysFreeString
VariantInit
SysStringLen
VariantClear
SysAllocString
ole32
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
comctl32
ord16
Exports
Exports
AdmClose
AdmFinishedA
AdmFinishedW
AdmInitA
AdmInitW
AdmResetA
AdmResetW
AdmSaveData
CheckDuplicateKeysA
CheckDuplicateKeysW
CreateAdmUiA
CreateAdmUiW
DllMain
GetAdmCategoriesA
GetAdmCategoriesW
GetFontInfoA
GetFontInfoW
IsAdmDirty
ResetAdmDirtyFlag
Sections
.text Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ