XactEngine2_8.pdb
Static task
static1
Behavioral task
behavioral1
Sample
64219686bc1ff2cfe0d199f09f52e8c9_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
64219686bc1ff2cfe0d199f09f52e8c9_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
64219686bc1ff2cfe0d199f09f52e8c9_JaffaCakes118
-
Size
1000KB
-
MD5
64219686bc1ff2cfe0d199f09f52e8c9
-
SHA1
cb31db5c24cb74fb1d1d33f95dacaed6df3f97e2
-
SHA256
55b355e99a9fb816a668c6cfa8bb33aa523d94ecf7cf4d6a01473c12e2885016
-
SHA512
d230408febb846ebaf4242c507f1fb15bf6b51b73d8929b5614805e30288b639f4acc126b9ea4f9483d1b841f9ccd1314a3cb0bafa9df1d63a7d1919d09a0de0
-
SSDEEP
12288:B4wT2p4lc5UXq7zxxi4wT2p4lc5UXq7zxxxxi4wT2p4lc5UXq7I:Zs4lKPvxxKs4lKPvxxxxKs4lKP8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 64219686bc1ff2cfe0d199f09f52e8c9_JaffaCakes118
Files
-
64219686bc1ff2cfe0d199f09f52e8c9_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
aa03b8ad7ee0b4904fd019f6a47f17db
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_aligned_free
_onexit
__dllonexit
_vsnwprintf
_adjust_fdiv
_initterm
strncpy
_CIacos
free
malloc
floor
??2@YAPAXI@Z
_aligned_malloc
_CIpow
wcslen
_isnan
_purecall
??3@YAXPAX@Z
_except_handler3
_vsnprintf
_controlfp
kernel32
HeapSize
GetSystemInfo
LoadLibraryW
GetProcAddress
FreeLibrary
GetVersionExW
lstrcmpW
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
GetLastError
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
GetTickCount
QueryPerformanceCounter
HeapFree
GetProcessHeap
InterlockedCompareExchange
GetCurrentThreadId
HeapAlloc
InitializeCriticalSection
DeleteCriticalSection
CreateSemaphoreW
CloseHandle
CreateFileA
QueryPerformanceFrequency
GetOverlappedResult
ReadFile
InterlockedExchange
WaitForMultipleObjects
WaitForSingleObject
SetEvent
CreateThread
CreateEventA
Sleep
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
ReleaseSemaphore
GetFileSize
SetEndOfFile
CreateEventW
SetThreadPriority
SwitchToThread
TryEnterCriticalSection
GetCurrentProcess
WriteFile
SetFilePointer
rpcrt4
UuidToStringA
RpcStringFreeA
ole32
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
PropVariantClear
CLSIDFromString
advapi32
RegCreateKeyExA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
user32
GetDesktopWindow
winmm
timeEndPeriod
timeBeginPeriod
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 237KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
RT_CODE Size: 512B - Virtual size: 60B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ