stobject.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1746e524536dbb7e2c5a38b62f4924e0_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1746e524536dbb7e2c5a38b62f4924e0_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
1746e524536dbb7e2c5a38b62f4924e0_JaffaCakes118
-
Size
175KB
-
MD5
1746e524536dbb7e2c5a38b62f4924e0
-
SHA1
874fe9cde9493be3522f6985ab2ce77a1b2a5dc2
-
SHA256
3b4e3e46e3681770c027fdc4b788630183300056632243b76f57fcd711a70b26
-
SHA512
eee1909d32154c7f5fba3d6552f304a36ea27d00fdd3471de7a18957f41086fd7c046e9c7df55a3c49d1e2ba3ddb25f820f534bbbd2f55881f1ca3cfb7833ec9
-
SSDEEP
3072:FKmh/NmM/clF0qTvKNplaBFCeHp0ytdGW7YnMIyI3r9DoRBb8o:FfhG6qTv22HRnFI3r9URxn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1746e524536dbb7e2c5a38b62f4924e0_JaffaCakes118
Files
-
1746e524536dbb7e2c5a38b62f4924e0_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
39626de7aed60504be8f9ef131c8ba7a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
wcsncpy
wcschr
free
_initterm
malloc
_adjust_fdiv
_vsnwprintf
_except_handler3
ntdll
VerSetConditionMask
kernel32
GlobalAlloc
GetFileAttributesW
SearchPathW
WinExec
GetLastError
GetCurrentProcess
CreateEventW
WaitForSingleObject
SetLastError
SetEvent
CreateThread
ResetEvent
VerifyVersionInfoW
lstrcmpiW
GetVolumeNameForVolumeMountPointW
lstrlenW
GlobalLock
UnregisterWaitEx
UnregisterWait
QueryPerformanceFrequency
InterlockedDecrement
FreeLibraryAndExitThread
GetModuleFileNameW
DisableThreadLibraryCalls
InterlockedCompareExchange
LoadLibraryA
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GlobalHandle
GlobalUnlock
GlobalFree
CreateFileW
GetSystemDirectoryW
FormatMessageW
FreeLibrary
GetProcAddress
RegisterWaitForSingleObject
CloseHandle
GetWindowsDirectoryW
lstrcpynW
DelayLoadFailureHook
GetModuleHandleW
QueryPerformanceCounter
lstrcmpW
LocalFree
GetSystemPowerStatus
InterlockedIncrement
LoadLibraryW
LocalAlloc
gdi32
CreateBitmap
CreateCompatibleDC
SelectObject
BitBlt
GetPixel
SetPixel
DeleteDC
DeleteObject
GetObjectW
user32
IsWindow
GetSystemMetrics
DestroyMenu
CreatePopupMenu
SetMenuDefaultItem
CheckMenuRadioItem
AppendMenuW
SetMenuItemInfoW
SystemParametersInfoW
GetSysColor
GetIconInfo
CreateIconIndirect
DeregisterShellHookWindow
RegisterShellHookWindow
LoadImageW
DestroyIcon
RegisterWindowMessageW
LoadIconW
LoadCursorW
RegisterClassExW
CreateDialogParamW
GetMessageW
IsDialogMessageW
DispatchMessageW
DefWindowProcW
PostQuitMessage
WinHelpW
KillTimer
GetDoubleClickTime
SetTimer
GetDlgItem
TrackPopupMenu
GetMenuItemInfoW
RegisterDeviceNotificationW
CheckDlgButton
ShowWindow
InvalidateRect
LoadStringW
GetWindow
FindWindowW
SendMessageW
SetForegroundWindow
PostMessageW
IsDlgButtonChecked
EndDialog
UnregisterDeviceNotification
wsprintfW
GetCursorPos
SetFocus
TranslateMessage
shell32
ord2
ord89
ord195
Shell_NotifyIconW
ShellExecuteW
ord644
ord645
ord4
batmeter
CreateBatMeter
BatMeterCapabilities
UpdateBatMeter
PowerCapabilities
DestroyBatMeter
powrprof
EnumPwrSchemes
GetActivePwrScheme
WriteGlobalPwrPolicy
ReadGlobalPwrPolicy
SetActivePwrScheme
setupapi
CM_Get_Child
CM_Get_Sibling
CM_Get_Device_IDW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Is_Dock_Station_Present
CM_Get_Device_ID_ExW
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW
CM_Request_Device_Eject_ExW
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiCreateDeviceInfoListExW
SetupDiDeleteDeviceInfo
CM_Locate_DevNodeW
SetupDiOpenDeviceInfoW
CM_Get_DevNode_Status_Ex
SetupDiEnumDeviceInfo
CM_Get_DevNode_Registry_Property_ExW
CM_Get_DevNode_Registry_PropertyW
CM_Get_DevNode_Status
SetupDiGetDeviceInstanceIdW
ole32
CoInitializeEx
CoCreateInstance
StringFromGUID2
CoUninitialize
shlwapi
StrCpyNW
StrToIntW
PathAppendW
StrCatBuffW
PathFindFileNameW
advapi32
WmiOpenBlock
WmiReceiveNotificationsW
OpenProcessToken
GetTokenInformation
LookupPrivilegeValueW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
WmiCloseBlock
wtsapi32
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ