msfeedsbs.pdb
Static task
static1
Behavioral task
behavioral1
Sample
356a945eb69744309044532811fae296_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
356a945eb69744309044532811fae296_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
356a945eb69744309044532811fae296_JaffaCakes118
-
Size
110KB
-
MD5
356a945eb69744309044532811fae296
-
SHA1
64aef494463dfe8078b34d8fed8e1ba41d23dfc0
-
SHA256
1c7248ff7ec2f41d840c9e746fb22db66a02b7d6ce59bd6ccb1dea3279e5c2cd
-
SHA512
aa2b7f1e9f6b57dacfb8130c816e3adf558d9814651afb7e00a2eeac3494ab32b8dcac35fb957624f2d35a4395b2e8d728a107388977526bf04194cca687d61b
-
SSDEEP
1536:WnEkvL2TURCTRPiMrAZTxVY+jdNUONxzbKf5loIxoOOtE9geRN0jDTBp+U/8IVRj:WWTUwFB8hxoOjb26DOOtE8P8Ijazs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 356a945eb69744309044532811fae296_JaffaCakes118
Files
-
356a945eb69744309044532811fae296_JaffaCakes118.dll windows:6 windows x86 arch:x86
78627d584eade82839d2c2c1b52605b0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
??3@YAXPAX@Z
??2@YAPAXI@Z
_vsnwprintf
wcstoul
_purecall
wcsncmp
_wcsicmp
_wcsnicmp
bsearch
memmove
memcpy
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
_vsnprintf
memset
kernel32
HeapFree
WaitForSingleObject
WriteFile
MultiByteToWideChar
SearchPathW
FindResourceW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
UnmapViewOfFile
FreeLibrary
GetProcAddress
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
FindResourceExW
LoadResource
SetLastError
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
Sleep
InterlockedExchange
CompareFileTime
lstrlenW
CreateProcessW
LoadLibraryA
RaiseException
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
lstrlenA
WideCharToMultiByte
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLocaleInfoW
GetModuleFileNameW
GetVersionExW
GetProcessHeap
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
LocalFree
LocalAlloc
CloseHandle
GetLastError
CreateMutexW
ReleaseMutex
DeleteFileW
SetFileAttributesW
MoveFileExW
CreateFileW
GetSystemDirectoryW
FileTimeToSystemTime
SystemTimeToFileTime
GetCurrentProcess
advapi32
OpenProcessToken
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
ImpersonateLoggedOnUser
CreateRestrictedToken
GetTokenInformation
ConvertSidToStringSidW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RevertToSelf
GetTraceEnableFlags
ole32
CoCreateGuid
StringFromGUID2
CoCreateInstance
CoTaskMemFree
PropVariantClear
CLSIDFromString
CoTaskMemAlloc
shlwapi
PathFindFileNameW
PathRemoveFileSpecW
HashData
SHStrDupW
PathAppendW
ord437
StrCmpNW
SHGetValueW
SHRegGetValueW
SHSetValueW
PathFindExtensionW
iertutil
ord48
ord79
ord74
ord81
ord85
ord9
secur32
GetUserNameExW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ