c:\RPS\HPScripting\Release\HPScripting.pdb
Static task
static1
Behavioral task
behavioral1
Sample
49edd40822b39e61497f25834f468e67_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
49edd40822b39e61497f25834f468e67_JaffaCakes118
-
Size
172KB
-
MD5
49edd40822b39e61497f25834f468e67
-
SHA1
aac8eee8bd9feb40107fad6be5173ff0b01df9e6
-
SHA256
669fe2b33eed8c461e4dd110d607b2cf1194e37e93d88f1b34c58af3438179d6
-
SHA512
9dec322800b9848d8d17e69b8692af0d8a78826dc623e21b18f5cadecaf59dbb02c4a0456b156c63394d292128aad0d85c6fcbe922100f069fd15826f1554425
-
SSDEEP
3072:NdxNLxnyrPJ691rev4xJXKLwlvsAHG7vErWpKqM6MsI9BzT5:NdO091r+WX6esAHcvzMqSsI99
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49edd40822b39e61497f25834f468e67_JaffaCakes118
Files
-
49edd40822b39e61497f25834f468e67_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
8158b70edeb8683ba58515a9c17783d0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrlenA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
EnterCriticalSection
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcpyA
lstrcatA
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetModuleFileNameA
InterlockedExchange
VirtualQuery
GetSystemInfo
VirtualProtect
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetCPInfo
GetOEMCP
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
WriteFile
ExitProcess
RaiseException
RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
GetCurrentThreadId
TlsSetValue
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
TlsFree
SetLastError
TlsGetValue
TlsAlloc
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
user32
CharNextA
MessageBoxW
advapi32
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
ole32
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
CoTaskMemFree
oleaut32
SysAllocString
RegisterTypeLi
UnRegisterTypeLi
SysStringLen
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
VariantCopy
VariantClear
VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
SysFreeString
shlwapi
PathFindExtensionA
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ