marble.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3789ceb618274a0a71036239393bc2d1_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3789ceb618274a0a71036239393bc2d1_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3789ceb618274a0a71036239393bc2d1_JaffaCakes118
-
Size
272KB
-
MD5
3789ceb618274a0a71036239393bc2d1
-
SHA1
8f9edf95d8cb4ae5f18af7059742fa491b62ecd0
-
SHA256
4f4e3566490b527d375c0cb46479abc64048d9266855b9d27e91b360f639dca4
-
SHA512
86f46f6a211f5daee6a8cdb2d37afbadf8644806c460d17c9f39df6ac7ac55667d761a6ef204fb03be5a2295c8c60126148d7c08c955620db94040ce3f5cf270
-
SSDEEP
6144:VRI0VCaJzIGUv6VE6chz5TEdI92Cm4oHuQ3yD7aPT0Mv:DIYCD1vMUTEdIMAay6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3789ceb618274a0a71036239393bc2d1_JaffaCakes118
Files
-
3789ceb618274a0a71036239393bc2d1_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
575e6c981762ef24f51637d0917804bb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcr71
_except_handler3
_ismbcdigit
_atoi64
_mbscmp
_wcsicmp
??_U@YAPAXI@Z
_mbsicmp
_mbschr
??2@YAPAXI@Z
??_V@YAXPAX@Z
??3@YAXPAX@Z
free
atof
memset
_mbsnbcpy
_mbsrchr
_mbsnbcmp
_mbsinc
_mbsupr
_mbclen
wcslen
vsprintf
rename
remove
_itoa
_ultoa
mktime
_onexit
__dllonexit
__CppXcptFilter
_adjust_fdiv
_initterm
_ismbclower
atoi
realloc
wcsncpy
_purecall
_resetstkoflw
malloc
_mbsnbicmp
_snprintf
atol
_ismbcalpha
kernel32
FindClose
SetEndOfFile
UnlockFile
LockFile
CloseHandle
FlushFileBuffers
SetFilePointer
ReadFile
CreateFileA
DuplicateHandle
GetLocalTime
GetStdHandle
WriteFile
GetFileSize
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
GetLastError
lstrlenA
lstrcmpiA
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
lstrcpynA
lstrcpyA
GetModuleFileNameA
lstrcatA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetFileTime
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetVolumeInformationA
GetFileAttributesA
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetFullPathNameA
user32
wsprintfA
CharNextA
CharUpperA
ole32
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
StringFromGUID2
oleaut32
LoadTypeLi
SysAllocStringLen
SysStringLen
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
SysAllocString
SysFreeString
advapi32
RegisterEventSourceA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
CloseEventLog
OpenEventLogA
ReportEventA
DeregisterEventSource
shlwapi
PathFindExtensionA
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 168KB - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ