D:\Conduit\RnD\Client\IE\Dev\6.6\Setup\AutomaticUpdate\Release\AutomaticUpdate.pdb
Static task
static1
Behavioral task
behavioral1
Sample
637038ea26e10e27832535cdd2419b61_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
637038ea26e10e27832535cdd2419b61_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
637038ea26e10e27832535cdd2419b61_JaffaCakes118
-
Size
328KB
-
MD5
637038ea26e10e27832535cdd2419b61
-
SHA1
a76c92ffce223ebeabb9e5cf9d692206fb86c31f
-
SHA256
41add841a4d833da369a8e9e7f62694311608ed397c8d0b0be55c49bbbec56a8
-
SHA512
04e8f684e928624b53d0233845d052a7593a18c545211ab8f3851e790617b52f5771a7193f4bb8041171093f546aac96a1cac38eb7a4bd4dabd4589eeecb9b30
-
SSDEEP
6144:Cm2pwsRVnsz2qsgP0agA1cXbHUTW1H3S2+yXWpG5:C7SsPsz2G0aN14b0yJ9uo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 637038ea26e10e27832535cdd2419b61_JaffaCakes118
Files
-
637038ea26e10e27832535cdd2419b61_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
5f3423b4630da801f6200f40f5a25ec7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CloseHandle
LockResource
GetProcAddress
LocalAlloc
LocalFree
GetCurrentProcessId
OpenProcess
TerminateProcess
GetCurrentProcess
GetTickCount
LoadLibraryA
GetVersionExA
DeleteFileW
GetModuleHandleW
Sleep
GetModuleFileNameW
GetLongPathNameW
GetModuleHandleA
GetComputerNameW
MultiByteToWideChar
GetLastError
GetSystemTimeAsFileTime
CreateFileW
ReadFile
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
TlsAlloc
TlsSetValue
TlsGetValue
SetFilePointer
WriteFile
SetLastError
InterlockedIncrement
GetLocalTime
GetCommandLineA
HeapAlloc
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
GetConsoleCP
GetConsoleMode
GetFileType
RaiseException
RtlUnwind
TlsFree
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
FlushFileBuffers
LCMapStringA
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
CreateFileA
SizeofResource
LoadLibraryW
OutputDebugStringW
WaitForSingleObject
CreateProcessW
LoadResource
FreeLibrary
WideCharToMultiByte
FindResourceW
shlwapi
PathFileExistsW
PathFindFileNameW
user32
PostMessageA
IsWindow
SendMessageA
IsWindowVisible
RegisterWindowMessageW
advapi32
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
GetUserNameW
shell32
SHCreateDirectoryExW
SHGetFolderPathW
ole32
CoTaskMemFree
Exports
Exports
DllOnUpdateFinish
DllRegisterServer
Sections
.text Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ