f:\binaries.x86ret\bin\i386\bbt\opt\bin\i386\csm.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2c8c112e50e2a189e4029c4f6d0d2e40_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2c8c112e50e2a189e4029c4f6d0d2e40_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2c8c112e50e2a189e4029c4f6d0d2e40_JaffaCakes118
-
Size
238KB
-
MD5
2c8c112e50e2a189e4029c4f6d0d2e40
-
SHA1
99471ce1e6e27095276d529a086923360921d3ae
-
SHA256
0ac515da38e4c8f598fd0d4b12b6d1b9d12e6c3135c17d279bd1e427afb4d7e0
-
SHA512
9c850b1e5e21fa3b2b90db03bfc92b9e504a1fc6cf4a54168388e10de9dfc546751c28123ded6eea4db3023497d2c605167c39cd06a9c6dd5a37855f020d77d1
-
SSDEEP
6144:qJDNkp+rOhtSJbsRIvwMI1E6rgOMzKFeukO30SNm9kDvvLHB:qr7yhMJsiwt1EpKeuQSm9Gvjh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c8c112e50e2a189e4029c4f6d0d2e40_JaffaCakes118
Files
-
2c8c112e50e2a189e4029c4f6d0d2e40_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
364d384615b628414b8146eb076c099b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
advapi32
ImpersonateNamedPipeClient
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegCloseKey
RegDeleteKeyA
EqualSid
SetKernelObjectSecurity
GetAce
GetKernelObjectSecurity
SetThreadToken
OpenThreadToken
IsValidSid
CopySid
GetLengthSid
GetSidSubAuthority
GetSecurityDescriptorControl
MakeAbsoluteSD
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetAclInformation
InitializeAcl
AddAce
SetSecurityDescriptorDacl
GetSidLengthRequired
InitializeSid
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorSacl
OpenProcessToken
GetTokenInformation
RevertToSelf
kernel32
RaiseException
LoadLibraryExA
DisableThreadLibraryCalls
FindResourceA
SizeofResource
LoadResource
CreateFileA
ReadFile
CreateMailslotA
WaitNamedPipeW
CreateFileW
ConnectNamedPipe
CreateNamedPipeW
CancelIo
GetOverlappedResult
CreateFileMappingA
MapViewOfFileEx
OpenFileMappingA
CreateFileMappingW
OpenFileMappingW
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
VirtualProtect
VirtualAlloc
GetProcAddress
GetModuleHandleA
GetSystemInfo
VirtualQuery
HeapReAlloc
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
IsDBCSLeadByte
VirtualFree
UnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
GetCPInfo
GetACP
GetOEMCP
RtlUnwind
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetThreadLocale
GetComputerNameA
GetComputerNameW
OpenProcess
LocalAlloc
GetModuleFileNameW
DisconnectNamedPipe
WriteFile
FreeLibraryAndExitThread
OpenEventA
OpenEventW
GetExitCodeThread
WaitForMultipleObjects
CreateThread
GetCurrentProcess
DuplicateHandle
LoadLibraryA
GetModuleFileNameA
FreeLibrary
UnmapViewOfFile
GetCurrentThread
GetCurrentProcessId
GetCurrentThreadId
CreateEventA
CreateEventW
WaitForSingleObject
SetEvent
ResetEvent
InterlockedCompareExchange
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
GetVersion
lstrcmpiA
GetLastError
InterlockedExchange
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
HeapCreate
ole32
CoUninitialize
CoDisconnectObject
CoTaskMemRealloc
CoTaskMemAlloc
CLSIDFromString
CoInitializeEx
CoMarshalInterThreadInterfaceInStream
CoReleaseMarshalData
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoCreateGuid
StringFromGUID2
CoGetInterfaceAndReleaseStream
oleaut32
VarUI4FromStr
user32
CharNextA
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 116KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE