C:\DOCUME~1\bld4act\LOCALS~1\Temp\Hpolaris\optPolaris\baseline\WMPBand.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6225ce956073f677121e05616aac3b6c_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6225ce956073f677121e05616aac3b6c_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6225ce956073f677121e05616aac3b6c_JaffaCakes118
-
Size
150KB
-
MD5
6225ce956073f677121e05616aac3b6c
-
SHA1
1ce1f0181ec62bf726e8994f7f26d07494ba37ab
-
SHA256
4a2a55a1a38083d2e512285d2dc329727c61a321a336c36051279b8cb69afa5e
-
SHA512
512be91471fd48585113f97c3cf8087d4b18d4cd6f35f5fc68a2f9c0f49201b8a4e302da37bb61974acdb5f49c94f420a6050be792f5fd4b7a7dd85482fda7ab
-
SSDEEP
3072:4Z3MwTLa9oSmkEkjZtLZKuTnXR/LssR4lpA8nehvMYk:sxT+oZ8tLwgXR/LssJs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6225ce956073f677121e05616aac3b6c_JaffaCakes118
Files
-
6225ce956073f677121e05616aac3b6c_JaffaCakes118.dll regsvr32 windows:6 windows x86 arch:x86
cef4fbca5da8f1ceb161e89d7b681856
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_wtoi
towupper
wcsstr
bsearch
iswdigit
wcsncmp
??_U@YAPAXI@Z
wcschr
wcspbrk
wcsrchr
_beginthreadex
_vsnwprintf
_wcsnicmp
towlower
iswspace
_wtol
_wcsicmp
_onexit
_lock
__dllonexit
_unlock
memmove
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
??_V@YAXPAX@Z
memcpy
realloc
malloc
memset
??2@YAPAXI@Z
free
_purecall
??3@YAXPAX@Z
uxtheme
OpenThemeData
DrawThemeParentBackground
CloseThemeData
kernel32
SetErrorMode
CreateThread
WaitForSingleObject
CreateMutexW
DebugBreak
GetDriveTypeW
CreateFileW
WideCharToMultiByte
CloseHandle
DeviceIoControl
CreateFileA
GetVersion
GetLastError
lstrcpyW
InitializeCriticalSection
QueryDosDeviceW
InterlockedIncrement
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
lstrlenW
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryW
GetVersionExW
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
MultiByteToWideChar
lstrcmpiW
RaiseException
lstrcpynW
lstrcatW
GlobalAddAtomW
GlobalDeleteAtom
lstrlenA
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetFileAttributesW
SetLastError
GetExitCodeThread
DeleteCriticalSection
ExpandEnvironmentStringsW
CompareStringW
CompareStringA
advapi32
RegQueryValueExW
TraceMessage
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
ole32
CreateStreamOnHGlobal
OleLockRunning
CoCreateInstance
CoTaskMemFree
StringFromGUID2
CoInitializeEx
CoUninitialize
CoMarshalInterface
CoUnmarshalInterface
RegisterDragDrop
RevokeDragDrop
CoTaskMemRealloc
CoTaskMemAlloc
oleaut32
VariantInit
VariantClear
SysStringLen
RegisterTypeLi
VarUI4FromStr
SysAllocString
SysFreeString
SysAllocStringLen
LoadRegTypeLi
VariantCopy
VariantChangeType
LoadTypeLi
user32
FillRect
SetForegroundWindow
CharPrevW
SetWindowPos
SendMessageW
EnumWindows
GetClassNameW
GetParent
FindWindowW
IsWindowVisible
ShowWindow
PostMessageW
CharNextW
LoadCursorW
RegisterClassW
CreateWindowExW
SetLayeredWindowAttributes
SetWindowLongW
BeginPaint
EndPaint
UnregisterClassW
DestroyAcceleratorTable
GetClientRect
CreateAcceleratorTableW
IsWindow
DestroyWindow
DefWindowProcW
InvalidateRgn
InvalidateRect
GetTopWindow
GetDC
SetFocus
GetFocus
KillTimer
IntersectRect
SetTimer
GetDesktopWindow
MonitorFromRect
GetMonitorInfoW
GetWindowLongW
GetWindow
GetWindowRect
EqualRect
SetRect
UnregisterHotKey
GetClassNameA
GetWindowThreadProcessId
SendMessageTimeoutA
GetAsyncKeyState
CharNextA
RegisterHotKey
IsIconic
ReleaseDC
GetCursorPos
gdi32
GetDeviceCaps
shell32
ShellExecuteExW
shlwapi
PathGetCharTypeW
PathGetCharTypeA
mpr
WNetAddConnection2W
WNetCancelConnection2W
WNetGetConnectionW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 58KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ