adprovider.pdb
Static task
static1
Behavioral task
behavioral1
Sample
28232273f00344090e559f194b59fa7d_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
28232273f00344090e559f194b59fa7d_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
28232273f00344090e559f194b59fa7d_JaffaCakes118
-
Size
49KB
-
MD5
28232273f00344090e559f194b59fa7d
-
SHA1
ea8d58412ceca5dd1c460e95615ec55c38faa652
-
SHA256
4f3c73888aa27c4365e68bd3bc1a5c8ac87762685b99803d54537cbe5677b102
-
SHA512
3de245f26c6d820ba3fa8593a3fe17e7b0de69ac4f100d4273bf0ad6b878f692270660b06d8cb33876477ba1b99ac9ce2f8f338aee6922b666740513a1a860e7
-
SSDEEP
1536:AXe89Zvi/L4kWEX7JjCLZ6x8LlqPvgYZd:QZa/ELa2cngYZd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 28232273f00344090e559f194b59fa7d_JaffaCakes118
Files
-
28232273f00344090e559f194b59fa7d_JaffaCakes118.dll regsvr32 windows:6 windows x86 arch:x86
9a18a660b45ea96c4b16fe667835078c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
wcscat_s
_ultow
??3@YAXPAX@Z
memcpy
_wcsicmp
memset
malloc
memcpy_s
wcstoul
_wcsnicmp
_vsnwprintf
_atoi64
_purecall
??2@YAPAXI@Z
??_U@YAPAXI@Z
wcschr
_errno
realloc
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
_amsg_exit
_initterm
_XcptFilter
wcsncpy_s
wcscpy_s
free
??_V@YAXPAX@Z
kernel32
SystemTimeToFileTime
lstrlenW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
SetThreadLocale
GetThreadLocale
lstrcmpiW
GetSystemTimeAsFileTime
CompareFileTime
FreeLibrary
MultiByteToWideChar
LoadResource
FindResourceW
LoadLibraryExW
GetVersionExA
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
OutputDebugStringA
LocalFree
LocalAlloc
SizeofResource
advapi32
RegQueryValueExW
CryptAcquireContextW
CryptGetUserKey
CryptDestroyKey
CryptReleaseContext
RegOpenCurrentUser
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
TraceMessage
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
wldap32
ord10
ord97
ord40
ord152
ord14
ord190
ord73
ord13
ord140
ord224
ord208
ord26
ord88
ord16
ord127
ord142
ord79
ord147
ord167
ord301
ord41
ord12
ord118
ord18
ord145
ntdsapi
DsReplicaGetInfo2W
DsReplicaFreeInfo
DsBindW
DsUnBindW
netapi32
DsGetDcNameW
NetApiBufferFree
crypt32
CertAddSerializedElementToStore
CryptHashCertificate
CertGetCertificateContextProperty
CertFreeCertificateContext
oleaut32
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysFreeString
ole32
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
CoTaskMemFree
user32
CharNextW
UnregisterClassA
secur32
GetUserNameExW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ