D:\VC8\AVIAddXSubs\AVIAddXSubs\Release\AVIAddXSubs.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2dfe1ed2a0f1c249a847c03ecc1a163b_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2dfe1ed2a0f1c249a847c03ecc1a163b_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2dfe1ed2a0f1c249a847c03ecc1a163b_JaffaCakes118
-
Size
191KB
-
MD5
2dfe1ed2a0f1c249a847c03ecc1a163b
-
SHA1
ae853618cb4c17cb69674af0f32c92db34a0907d
-
SHA256
e52210ced4b6025a25ee1f2483458845adb4ea698e887a9c16da57130d7b232b
-
SHA512
2de65d607eb207510637d938cb6a4d11d0b739917296cba75610e991dc35ebdc28d51c91f96024179eb52b93d5f9dd1735a893fee6295a4c68331e07b3e61eca
-
SSDEEP
3072:GOOggg8mdhzT6fEx0Je8SHJPo5fYQTV2l51e6HJS8Ncl9/ejKmVn6K:nEI7zT6WKy0YQTVg5xHJTNcl9WWY1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dfe1ed2a0f1c249a847c03ecc1a163b_JaffaCakes118
Files
-
2dfe1ed2a0f1c249a847c03ecc1a163b_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
c9b665cbb1cdc43fcb98bf13bbcc8911
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
lstrlenA
lstrcmpiA
LoadLibraryA
GetModuleHandleW
IsDBCSLeadByte
InterlockedIncrement
InterlockedDecrement
FreeLibrary
SizeofResource
LoadResource
FindResourceA
GetModuleHandleA
GlobalUnlock
GlobalLock
CloseHandle
CreateProcessA
lstrcpynA
lstrcpynW
FlushFileBuffers
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
LoadLibraryExA
MultiByteToWideChar
CreateFileW
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryW
GetStringTypeW
LCMapStringW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
DecodePointer
EncodePointer
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
HeapDestroy
HeapSize
IsProcessorFeaturePresent
Sleep
SetHandleCount
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
user32
InsertMenuA
CharNextW
CharNextA
advapi32
RegEnumKeyExA
RegQueryInfoKeyW
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
shell32
DragQueryFileA
ole32
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
ReleaseStgMedium
CoTaskMemAlloc
StringFromGUID2
oleaut32
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen
Exports
Exports
BitCopy
BitsUsed
ChangeColor
CopyImg
CountColors
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EncodeIdxSubBitmap
FixColors
GetLetter
GetSubBitmap
LetterID
MrgLetters
RmvEmptySpace
ScanFrame
freemem
xsub_decode
xsub_encode
xsub_encode2
Sections
.text Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ