corpol.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5c685d86828c69b59f112758944de486_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5c685d86828c69b59f112758944de486_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5c685d86828c69b59f112758944de486_JaffaCakes118
-
Size
210KB
-
MD5
5c685d86828c69b59f112758944de486
-
SHA1
cf034bff22b576e63f449646fb943d7c0e672e4b
-
SHA256
2ac9f341e319ec9a24a92969bdf0e6e1d671057e8c64965511d5b4d13ee8c5e2
-
SHA512
204ff554c09706c02635dc0bad857953f7e2cfaac6db693b8c9d438a28dfdedeb6eca0d5b2127a2564368a5a5712e1d84f882ceb89053f088b7008a6f13cb33e
-
SSDEEP
3072:2rhe0xsoVER3tdjqXQTT8k+LmbdaUAE5Qm0ptAFci8Tz9+PcSUoibdk0LkNjh:Mg0XVYddCYIPUgtd2aTzEkPoibFL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c685d86828c69b59f112758944de486_JaffaCakes118
Files
-
5c685d86828c69b59f112758944de486_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
e71d5a4d5f64eb9ff257075cbd62699a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntdll
RtlUnwind
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCommandLineA
GetVersionExA
ExitProcess
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
WriteFile
HeapAlloc
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
LCMapStringA
QueryPerformanceCounter
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualProtect
GetCurrentProcess
VirtualQuery
InterlockedExchange
lstrlenW
DisableThreadLibraryCalls
GetLastError
DeleteCriticalSection
InitializeCriticalSection
FreeLibrary
EnterCriticalSection
LoadLibraryA
GetProcAddress
LeaveCriticalSection
LocalFree
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
CloseHandle
FlushFileBuffers
SetFilePointer
SetStdHandle
GetCurrentThreadId
GetSystemInfo
GetTickCount
LocalAlloc
MultiByteToWideChar
user32
GetFocus
ole32
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoUninitialize
wintrust
WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperCertCheckValidSignature
WTHelperGetProvCertFromChain
WintrustLoadFunctionPointers
WintrustRemoveActionID
WintrustAddActionID
crypt32
CertFindAttribute
CryptEncodeObject
urlmon
CoInternetCreateSecurityManager
Exports
Exports
CORLockDownProvider
CORPolicyEE
CORPolicyProvider
DllCanUnloadNow
DllRegisterServer
DllUnregisterServer
GetPublisher
GetUnsignedPermissions
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 178KB - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ