qasf.pdb
Static task
static1
Behavioral task
behavioral1
Sample
46c0ec417c8507dd6dfd4e3f4e128cbf_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
46c0ec417c8507dd6dfd4e3f4e128cbf_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
46c0ec417c8507dd6dfd4e3f4e128cbf_JaffaCakes118
-
Size
328KB
-
MD5
46c0ec417c8507dd6dfd4e3f4e128cbf
-
SHA1
3849d178499d79491745ecbd2e0bba597bc8029d
-
SHA256
5f9f3beb4f2ce145bd18df4011c3afa85cf35d2bb1cab5258e388f86869d9630
-
SHA512
494fb3cac2f54823efc62c420be1d346b16ee0e53b9a6a5807a632d87e97c80326929f0aa8b85be0c70bb7cb0ba2ef960340d1def301bf368b8677be220bd865
-
SSDEEP
6144:ST/Eo28yBPKRa3GYn0o8JKvVFwfVLn4ZBxXW+cJTdA9r:FoON2Fo8JOVFCnRZW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 46c0ec417c8507dd6dfd4e3f4e128cbf_JaffaCakes118
Files
-
46c0ec417c8507dd6dfd4e3f4e128cbf_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
ac57bd15292736839467367977cb70c8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
memmove
vswprintf
swprintf
_ftol
__CxxFrameHandler
_CIpow
_wtoi
wcscat
wcscpy
_except_handler3
wcslen
??2@YAPAXI@Z
wcschr
_purecall
free
_initterm
malloc
_adjust_fdiv
??3@YAXPAX@Z
kernel32
lstrcpyW
IsBadWritePtr
GetVersionExW
GetDiskFreeSpaceA
lstrcmpW
lstrcmpA
lstrcatW
LoadLibraryW
LoadLibraryA
lstrcpynW
GetModuleHandleW
GetModuleFileNameW
LocalAlloc
LocalFree
lstrlenW
GetVersionExA
WideCharToMultiByte
Sleep
DeviceIoControl
HeapFree
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GlobalMemoryStatus
GetLocalTime
HeapAlloc
GetProcessHeap
DisableThreadLibraryCalls
FindAtomW
QueryPerformanceCounter
GetTickCount
CreateSemaphoreW
CreateSemaphoreA
CreateEventW
CreateEventA
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
MultiByteToWideChar
lstrlenA
GetLastError
GetModuleFileNameA
InterlockedIncrement
FreeLibrary
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CloseHandle
SetEvent
ResetEvent
WaitForSingleObject
ReleaseSemaphore
GetSystemInfo
VirtualFree
VirtualAlloc
GetProcAddress
SetThreadPriority
InterlockedExchange
CreateThread
GetModuleHandleA
gdi32
GetTextExtentPointW
GetTextExtentPointA
user32
RegisterWindowMessageA
IsWindow
SendMessageW
SetWindowLongA
SetWindowLongW
wvsprintfW
GetWindowTextA
GetWindowLongW
GetWindowLongA
GetClassNameA
GetClassLongA
GetWindowRect
ShowWindow
DefWindowProcW
DefWindowProcA
CreateDialogParamW
GetDesktopWindow
MessageBoxW
LoadStringW
LoadStringA
CreateDialogParamA
SendMessageA
IsRectEmpty
GetDlgItemInt
GetDlgItem
SetDlgItemInt
GetDC
GetWindowTextW
ReleaseDC
InvalidateRect
DestroyWindow
MoveWindow
advapi32
RegQueryValueExA
RegCreateKeyExA
RegCreateKeyExW
RegCreateKeyA
RegCreateKeyW
RegDeleteKeyA
RegDeleteKeyW
RegEnumKeyExW
RegEnumKeyExA
RegQueryValueExW
RegCloseKey
RegSetValueW
RegSetValueA
RegSetValueExW
RegSetValueExA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyExA
ole32
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoFreeUnusedLibraries
CoUninitialize
StringFromGUID2
CoCreateInstance
oleaut32
SysAllocStringLen
VariantInit
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 200KB - Virtual size: 199KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ