custsat.pdb
Static task
static1
Behavioral task
behavioral1
Sample
626b6d7af2ab5bd3e4864c43127560c5_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
626b6d7af2ab5bd3e4864c43127560c5_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
626b6d7af2ab5bd3e4864c43127560c5_JaffaCakes118
-
Size
132KB
-
MD5
626b6d7af2ab5bd3e4864c43127560c5
-
SHA1
63d3046abd521d857983292694580782e8d07169
-
SHA256
1eb391ba5096afb0d0c2b349e8efacc3a0f9233c612993e7d92418ca4e473d0b
-
SHA512
c65989ffc6273ed7b6b9e8e08654f1e3933a01d3be2ddf96542e5d47af73d2d3d414a19dd0d4427d65e34d1089158c6aa4b226b98b96583565a5bfb1112c273e
-
SSDEEP
3072:PLaTjeSgjngx9sKKMvT4nHVBdWLtXyK35W4Xjw1dyk0H:zanuzKbqVBoL9yKU4XjwL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 626b6d7af2ab5bd3e4864c43127560c5_JaffaCakes118
Files
-
626b6d7af2ab5bd3e4864c43127560c5_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
f90ababd4b92e5ccd69f283bca292e7c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
??3@YAXPAX@Z
_ftol
ceil
??2@YAPAXI@Z
free
realloc
_except_handler3
advapi32
RegCloseKey
shlwapi
SHSetValueW
PathFindFileNameW
wnsprintfW
PathFileExistsW
wnsprintfA
SHStrDupW
SHGetValueW
StrCpyNW
ole32
CreateBindCtx
StringFromGUID2
CoCreateGuid
CreateStreamOnHGlobal
oleaut32
SysAllocString
SysFreeString
kernel32
GetSystemInfo
CreateEventA
LocalAlloc
GetProcAddress
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateFileMappingA
LocalReAlloc
LeaveCriticalSection
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetLastError
GetVersion
VirtualQuery
FlushInstructionCache
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
FreeLibrary
InterlockedExchange
CompareStringA
FindClose
ResetEvent
DisableThreadLibraryCalls
LoadLibraryA
IsBadWritePtr
IsBadCodePtr
IsBadReadPtr
GetVersionExA
LocalFree
GetLastError
GetSystemTimeAsFileTime
CloseHandle
SystemTimeToFileTime
GetCurrentProcess
CompareFileTime
UnmapViewOfFile
GetSystemTime
MapViewOfFile
GetTickCount
InterlockedIncrement
SetEvent
EnterCriticalSection
WaitForSingleObject
VirtualAlloc
WriteFile
GlobalFree
ReadFile
GlobalAlloc
GetFileSize
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 636B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ