d:\playground\smart_lock_v2\smartlock\release\SmartLock.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1b0aa3de0e8b5189ef97db1d8fe80297_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1b0aa3de0e8b5189ef97db1d8fe80297_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
1b0aa3de0e8b5189ef97db1d8fe80297_JaffaCakes118
-
Size
204KB
-
MD5
1b0aa3de0e8b5189ef97db1d8fe80297
-
SHA1
fa8267ebed0a0c8f9c820f350e711547302afeff
-
SHA256
6af6661121187c68e078ccb94bb49bd209aa4bf5f8974a1a8697106a766cd23c
-
SHA512
884854ee63773750a0099264708764e8302e947ea1059228170c3f1844dc164564614373a8e53d3a0d7038a22c590bcebb49e3523187193ac2ac1f8eb3cf134a
-
SSDEEP
3072:E9c6d+/biFjtaSORjfj3X1jIq3QpY7EEYgyz+TN19oj/bAd7Wdzm:Yc6h5v7Y75YByTr9B9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b0aa3de0e8b5189ef97db1d8fe80297_JaffaCakes118
Files
-
1b0aa3de0e8b5189ef97db1d8fe80297_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
2ec8a174a8d3dbe081b2c6231e4bfc28
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
rpcrt4
NdrDllRegisterProxy
NdrStubForwardingFunction
NdrOleFree
NdrOleAllocate
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrDllUnregisterProxy
NdrStubCall2
NdrCStdStubBuffer2_Release
kernel32
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
GetCurrentProcess
SetThreadLocale
GetThreadLocale
HeapAlloc
HeapFree
RtlUnwind
HeapReAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
GetProcAddress
GetModuleHandleA
ExitProcess
GetLastError
GetStdHandle
GetModuleFileNameA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
WideCharToMultiByte
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
DeleteCriticalSection
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
InterlockedExchange
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
InitializeCriticalSection
RaiseException
lstrlenW
WriteFile
FreeEnvironmentStringsW
user32
ExitWindowsEx
UnregisterClassA
CharNextW
advapi32
ControlService
OpenServiceW
StartServiceW
OpenSCManagerW
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
ole32
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
oleaut32
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
SysFreeString
VarUI4FromStr
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocString
SysAllocStringByteLen
SysStringByteLen
UnRegisterTypeLi
RegisterTypeLi
SysAllocStringLen
BSTR_UserFree
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 80KB - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ