sqlceoledb30.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4600a1f3d5cb5ae208cdc9d753af92d7_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4600a1f3d5cb5ae208cdc9d753af92d7_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4600a1f3d5cb5ae208cdc9d753af92d7_JaffaCakes118
-
Size
186KB
-
MD5
4600a1f3d5cb5ae208cdc9d753af92d7
-
SHA1
79e8ef049589c997ed83b13beb3aa85590e65be7
-
SHA256
bf654a67edadae418a412f562cc1e9ff87cc3bd7237edfe6fdc4243f91f3c9ec
-
SHA512
c376627e4bef069d9a377921e9b9aaa45073a6400c27de054bdecd150a7e721f2668f8aed01213f192625fabfc31fbbf03c3c7208f304a643dcd27ef2a2939bd
-
SSDEEP
3072:BtVvJ2vX+TbcMygENarAKASnlrHzZ9eVtacU56pPdbKkTHzjUnX+KNOKe990ku:BtOXscMyVNarAKnrHzHeVtacUyl13jUL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4600a1f3d5cb5ae208cdc9d753af92d7_JaffaCakes118
Files
-
4600a1f3d5cb5ae208cdc9d753af92d7_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
0b37670aa79eba6fcc2b3e3f7224fba9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetTickCount
LocalFree
GetUserDefaultLCID
InterlockedDecrement
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
InterlockedExchange
SetLastError
CompareStringA
InterlockedIncrement
WaitForSingleObject
ReleaseMutex
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
GetLastError
CloseHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
advapi32
RegCloseKey
ole32
StringFromGUID2
CLSIDFromString
CoCreateGuid
CoGetMalloc
CoCreateInstance
oleaut32
SetErrorInfo
SysAllocString
GetErrorInfo
VariantClear
VariantInit
SysFreeString
VariantChangeType
VariantCopy
msvcrt
malloc
realloc
rand
wcscmp
_initterm
_adjust_fdiv
free
_onexit
wcscpy
_purecall
wcslen
memcmp
swprintf
srand
_wcsicmp
wcsncpy
_snwprintf
memcpy
??2@YAPAXI@Z
__dllonexit
memset
_wcsnicmp
wprintf
??3@YAXPAX@Z
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ