msfeedsbs.pdb
Static task
static1
Behavioral task
behavioral1
Sample
48a391756c8a1ef3ae2fd2eeeb2521b6_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
48a391756c8a1ef3ae2fd2eeeb2521b6_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
48a391756c8a1ef3ae2fd2eeeb2521b6_JaffaCakes118
-
Size
152KB
-
MD5
48a391756c8a1ef3ae2fd2eeeb2521b6
-
SHA1
5918b7ec2e792af2e6a271743c0555739401a796
-
SHA256
bd62ad3a820f28a96c27df0c79436454c96c9989d0bf5ef806b07b08db78db6f
-
SHA512
4889c54ec4a2b8af13cf22b811377cca36c4502e3a082cca11437473f0daf073e9807ffb5a50b400a4e70bc5c89420486a7bf0d457b3166aba7046113cd39a17
-
SSDEEP
3072:VTUwFBbNxoO3bzTBQ0UAKNgGn2G+u+MEpHjCkpkaflWV9v+rO:3BBNL3UZSGn2GmMEpHjCkPflCI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 48a391756c8a1ef3ae2fd2eeeb2521b6_JaffaCakes118
Files
-
48a391756c8a1ef3ae2fd2eeeb2521b6_JaffaCakes118.dll windows:6 windows x86 arch:x86
11a9ac78d339a98c69ceb85d762bd2f0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
??3@YAXPAX@Z
??2@YAPAXI@Z
_vsnwprintf
wcstoul
_purecall
wcsncmp
_wcsicmp
_wcsnicmp
bsearch
memmove
memcpy
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
_vsnprintf
memset
kernel32
HeapFree
VirtualAlloc
WriteFile
MultiByteToWideChar
SearchPathW
FindResourceW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
UnmapViewOfFile
FreeLibrary
GetProcAddress
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
FindResourceExW
LoadResource
SetLastError
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
Sleep
InterlockedExchange
CompareFileTime
lstrlenW
CreateProcessW
LoadLibraryA
RaiseException
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
lstrlenA
WideCharToMultiByte
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLocaleInfoW
GetModuleFileNameW
GetVersionExW
GetProcessHeap
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
LocalFree
LocalAlloc
CloseHandle
GetLastError
CreateMutexW
ReleaseMutex
DeleteFileW
SetFileAttributesW
MoveFileExW
CreateFileW
GetSystemDirectoryW
FileTimeToSystemTime
SystemTimeToFileTime
GetCurrentProcess
advapi32
OpenProcessToken
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
ImpersonateLoggedOnUser
CreateRestrictedToken
GetTokenInformation
ConvertSidToStringSidW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RevertToSelf
GetTraceEnableFlags
ole32
CoCreateGuid
StringFromGUID2
CoCreateInstance
CoTaskMemFree
PropVariantClear
CLSIDFromString
CoTaskMemAlloc
shlwapi
PathFindFileNameW
PathRemoveFileSpecW
HashData
SHStrDupW
PathAppendW
ord437
StrCmpNW
SHGetValueW
SHRegGetValueW
SHSetValueW
PathFindExtensionW
iertutil
ord48
ord79
ord74
ord81
ord85
ord9
secur32
GetUserNameExW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ