e:\perf_rb_2008_07\scout\common\nmpluginbase\release\NMPluginBase.pdb
Static task
static1
Behavioral task
behavioral1
Sample
309a45e13fdc747f3c6126820b7c9d8e_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
309a45e13fdc747f3c6126820b7c9d8e_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
309a45e13fdc747f3c6126820b7c9d8e_JaffaCakes118
-
Size
204KB
-
MD5
309a45e13fdc747f3c6126820b7c9d8e
-
SHA1
be5e154b6d382ac6ac6a8d13a72f8a052bac6003
-
SHA256
9dcacbbcbdce1590b70693c223bae49da6567e88988bf842e26e7947d453aa0e
-
SHA512
def0d6892c9a63675986fbedf68f4124cf41f4d6f08c1eb2e0860f9ff1439d2ffcbdd492095edc54fa3c1fab171781edbdf333d9fd18528ed034c6b93b48878b
-
SSDEEP
6144:5aSw3e6D3jVk99uE0kOAgRY/9yglWNchzI4:ISwzD3jC99ulY/9ygQNch04
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 309a45e13fdc747f3c6126820b7c9d8e_JaffaCakes118
Files
-
309a45e13fdc747f3c6126820b7c9d8e_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
d6c283008aaaee6f64c5ace0c9ab4344
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetLastError
lstrcmpiW
FindClose
FindNextFileW
FreeLibrary
GetProcAddress
LoadLibraryW
FindFirstFileW
SetErrorMode
MultiByteToWideChar
SizeofResource
RaiseException
FindResourceW
LoadLibraryExW
GetModuleHandleW
SetThreadLocale
GetThreadLocale
InterlockedCompareExchange
WideCharToMultiByte
LocalAlloc
FormatMessageW
InterlockedExchange
GetModuleFileNameW
lstrlenW
InterlockedDecrement
InterlockedIncrement
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
LoadResource
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetLocaleInfoA
GetVersionExA
LocalFree
user32
wsprintfW
CharUpperBuffW
CharNextW
UnregisterClassA
advapi32
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
ole32
StringFromCLSID
CoTaskMemFree
CLSIDFromString
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
oleaut32
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
SysFreeString
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocString
SysAllocStringByteLen
SysStringByteLen
VarUI4FromStr
UnRegisterTypeLi
RegisterTypeLi
rpcrt4
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_QueryInterface
NdrStubCall2
NdrStubForwardingFunction
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrDllGetClassObject
NdrDllUnregisterProxy
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
NdrDllRegisterProxy
msvcr80
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
__CxxFrameHandler3
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
??_V@YAXPAX@Z
free
??_U@YAPAXI@Z
_wcsicmp
wcscpy_s
_wtol
malloc
memcpy_s
wcsncpy_s
wcscat_s
memset
_recalloc
fclose
_wfopen_s
_except_handler4_common
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
memmove_s
_CxxThrowException
_invalid_parameter_noinfo
??3@YAXPAX@Z
_wassert
fread
ftell
fseek
ferror
fputc
fprintf
_vsnprintf_s
isspace
tolower
isalpha
isalnum
strncmp
??0exception@std@@QAE@ABQBD@Z
strchr
shlwapi
PathRemoveFileSpecW
PathFindExtensionW
PathAppendW
msvcp80
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_Xran@_String_base@std@@SAXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 88KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ