w:\Anubis\capi\src\epoc_object\Release\epoc_object.pdb
Static task
static1
Behavioral task
behavioral1
Sample
38987e9dcba0732a672d4664f23c4001_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
38987e9dcba0732a672d4664f23c4001_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
38987e9dcba0732a672d4664f23c4001_JaffaCakes118
-
Size
352KB
-
MD5
38987e9dcba0732a672d4664f23c4001
-
SHA1
dd314e01982ffb8f7c788e1fb9b100fec0904963
-
SHA256
07ebf0a14b1d43e7613aa1cd9fd27fd9fb1168dbedb9809929f10d7429388984
-
SHA512
f6c70586e87b496654f0378939d684ddba1c8b841df92f3808d63239bb8d48e4abbee94e5e48215162769dd3313c7d26ea24eac5bfe506a8af0e754e17a0d8a3
-
SSDEEP
6144:s8O7UJlOEX9QVPAMzwaSk093Z/rnyQylyzqA6PM4bOcXzwdwHyZ9CXOL:s8O7UJltWJwaSlJrThqA6PM4bOcXzGw8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 38987e9dcba0732a672d4664f23c4001_JaffaCakes118
Files
-
38987e9dcba0732a672d4664f23c4001_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
1805d2c498941014983351494d0a494b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
RaiseException
lstrlenA
MultiByteToWideChar
GetModuleHandleA
GetModuleFileNameA
lstrlenW
GetLastError
WideCharToMultiByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
DisableThreadLibraryCalls
CloseHandle
Sleep
DeleteCriticalSection
GetStartupInfoA
SetLastError
FormatMessageA
HeapDestroy
HeapFree
HeapAlloc
HeapCreate
GetLocalTime
lstrcatA
lstrcpyA
InterlockedIncrement
InterlockedDecrement
CompareStringW
CompareStringA
GetLocaleInfoW
FlushFileBuffers
GetTimeZoneInformation
SetStdHandle
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
CreateProcessA
GetVersionExA
SetConsoleCtrlHandler
LCMapStringW
LCMapStringA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
SetEnvironmentVariableA
IsBadCodePtr
IsBadReadPtr
SetFilePointer
LoadLibraryA
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileType
ExitProcess
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TlsAlloc
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
TerminateProcess
GetCurrentProcess
HeapSize
VirtualFree
FatalAppExitA
IsBadWritePtr
GetOEMCP
GetCPInfo
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
user32
CharNextA
UnregisterClassA
FindWindowA
SendMessageA
wvsprintfA
advapi32
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegEnumValueA
ole32
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
oleaut32
VariantClear
SysFreeString
SysAllocString
VariantInit
VarUI4FromStr
RegisterTypeLi
SysStringLen
LoadRegTypeLi
UnRegisterTypeLi
LoadTypeLi
shlwapi
PathFindExtensionA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 108KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 180KB - Virtual size: 186KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ