oeimport.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3854600ef367629d96824451a559dfe7_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3854600ef367629d96824451a559dfe7_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3854600ef367629d96824451a559dfe7_JaffaCakes118
-
Size
274KB
-
MD5
3854600ef367629d96824451a559dfe7
-
SHA1
bd569309916b534e40d5bbd02a371e4850c8cdba
-
SHA256
aa4b756350cc7b0e1d3a04ba0ae44fe9d5ba730d6c27ad3da5754948f84552e1
-
SHA512
04e4b3d9899e65f45fdcad622866ea51956f39f029d13798d165c8e63ac7ebb5353f6ad255d4e7512751d1faa03b194f4c28fbe20814943ccc528ef5b1f108ce
-
SSDEEP
6144:ffomrJ9B8ngyIIM7FE1azgwzZHbmc8FAJRIMZ6AGWphZUg:4I3BQIL7xVNqZAUO+g
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3854600ef367629d96824451a559dfe7_JaffaCakes118
Files
-
3854600ef367629d96824451a559dfe7_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
1c43af31598ff2e7e3dc1c619453e230
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msoert2
CreateStreamOnHFile
HrCopyStream
FIsEmptyA
PszDupA
HrByteToStream
UlStripWhitespace
PszToUnicode
StrTokEx
ole32
CLSIDFromString
CoCreateInstance
CoTaskMemRealloc
CoGetMalloc
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegQueryInfoKeyA
CryptAcquireContextA
RegEnumKeyExA
gdi32
DeleteObject
kernel32
VirtualProtect
LoadLibraryA
lstrcpynA
lstrlenA
ExpandEnvironmentStringsA
FreeLibrary
GetProcAddress
FindClose
FindFirstFileA
UnmapViewOfFile
lstrcmpA
MapViewOfFile
CloseHandle
CreateFileMappingA
GetFileSize
CreateFileA
GetPrivateProfileStringA
GetProfileStringA
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
lstrcmpiA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersionExA
WideCharToMultiByte
SetLastError
GetModuleFileNameA
GetSystemInfo
GetEnvironmentVariableA
GetLastError
GetFileAttributesA
GetTimeZoneInformation
FindNextFileA
ReadFile
TlsSetValue
GetCommandLineA
ExitProcess
GetModuleHandleA
TlsFree
TlsGetValue
TlsAlloc
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualQuery
HeapCreate
VirtualFree
WriteFile
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
RtlUnwind
InterlockedExchange
HeapDestroy
user32
CreateDialogParamA
EndDialog
SetCursor
LoadCursorA
SendDlgItemMessageA
DialogBoxParamA
LoadBitmapA
GetSystemMetrics
GetWindowRect
MessageBoxA
GetWindowLongA
SetFocus
GetParent
GetWindowTextA
SetDlgItemTextA
GetDlgItemTextA
CharPrevA
DestroyWindow
SendMessageA
LoadStringA
KillTimer
SetWindowLongA
PeekMessageA
TranslateMessage
DispatchMessageA
GetDlgItem
SetWindowTextA
ShowWindow
SetTimer
PostMessageA
EnableWindow
comctl32
ImageList_AddMasked
CreatePropertySheetPageA
PropertySheetA
DestroyPropertySheetPage
InitCommonControlsEx
ImageList_Create
shlwapi
SHGetValueA
StrCmpNIA
StrStrIA
PathRemoveFileSpecA
StrCatBuffA
wnsprintfA
PathRemoveExtensionA
PathFileExistsA
PathAddBackslashA
SHSetValueA
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ExportMessages
PerformImport
PerformMigration
Sections
.text Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 175KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ