iepeers.pdb
Static task
static1
Behavioral task
behavioral1
Sample
65c91e5d59a301397a28397b28c2bc64_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
65c91e5d59a301397a28397b28c2bc64_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
65c91e5d59a301397a28397b28c2bc64_JaffaCakes118
-
Size
344KB
-
MD5
65c91e5d59a301397a28397b28c2bc64
-
SHA1
0e25d3f7f36a097b1ba8c626263ac695a93718bb
-
SHA256
d232d1a5c2182c49fbb25fcf3dbd1f0711d7f4032ebace05f12a76b8777daf12
-
SHA512
99adf3cd6cf41fb12cb5819bfa6f2610e7bcd0d43dc61c7abd350482d136416cd4db9d3f2732ce917c61dc42a1dae4a78275aee72c46b65ccdb93170ac03ecc1
-
SSDEEP
6144:74PfDTQP6u4sZifGxLZJWgZ+iERWgjJpJ5uwyzBUMq0AEBY:4Z5fcnzgjJpF3E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 65c91e5d59a301397a28397b28c2bc64_JaffaCakes118
Files
-
65c91e5d59a301397a28397b28c2bc64_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
c62ec4e6156a13209b7783e2ecb9524e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
??2@YAPAXI@Z
wcslen
wcscat
_purecall
wcsncpy
??3@YAXPAX@Z
_wtoi
_wcsnicmp
malloc
_ltow
wcscpy
_ftol
realloc
free
_wcsicmp
wcschr
wcscmp
towupper
_except_handler3
iswgraph
wcstol
floor
_initterm
_adjust_fdiv
__dllonexit
_onexit
shlwapi
ord309
ord97
SHRegGetValueW
ord311
ord310
ord77
ord418
ord54
ord378
ord48
ord144
ord402
ord362
ord435
ord108
ord441
ord436
ord83
ord52
ord105
ord66
ord347
ord123
ord80
ord130
ord125
ord120
ord128
ord126
ord121
ord40
ord45
ord2
ord340
ord107
ord176
SHGetValueW
StrDupW
StrCmpNIW
PathCombineA
UrlUnescapeW
SHRegOpenUSKeyW
SHRegQueryUSValueW
SHRegCloseUSKey
wnsprintfA
SHRegGetUSValueW
ord156
SHQueryValueExW
PathFindFileNameW
StrCpyNW
StrCatW
StrCmpIW
StrCpyW
ord158
StrCmpW
wnsprintfW
ole32
CreateBindCtx
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CreateStreamOnHGlobal
CoTaskMemRealloc
oleaut32
SafeArrayPutElement
VarI4FromStr
LoadTypeLi
RegisterTypeLi
SetErrorInfo
LoadRegTypeLi
VariantCopy
VariantChangeTypeEx
VariantClear
SysAllocStringLen
VariantInit
SafeArrayCreateVector
SysStringLen
SysAllocString
SysFreeString
SafeArrayCreate
gdi32
CreateDCA
SetViewportOrgEx
StartPage
DeleteDC
EndDoc
GetDeviceCaps
CreateICA
AbortDoc
EndPage
kernel32
QueryPerformanceCounter
GetLocalTime
GlobalFree
MulDiv
GlobalLock
GlobalUnlock
WriteFile
GetSystemTimeAsFileTime
LocalFree
GetDiskFreeSpaceA
CompareFileTime
GlobalAlloc
CloseHandle
LoadResource
SizeofResource
GetVersionExA
DisableThreadLibraryCalls
GetTickCount
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
lstrlenW
FileTimeToSystemTime
GetProcAddress
FreeLibrary
LoadLibraryA
GetModuleFileNameA
GetFullPathNameA
SearchPathA
LoadLibraryExA
MultiByteToWideChar
WideCharToMultiByte
SystemTimeToFileTime
InterlockedDecrement
InterlockedIncrement
GetVersionExW
GetLastError
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrcpynW
InitializeCriticalSectionAndSpinCount
LoadLibraryW
HeapDestroy
user32
GetDesktopWindow
SetTimer
KillTimer
GetSystemMetrics
DrawFrameControl
GetWindowRect
LoadStringA
advapi32
RegSetValueExA
RegOpenKeyExA
RegCloseKey
urlmon
FaultInIEFeature
CoInternetCreateSecurityManager
GetComponentIDFromCLSSPEC
CreateURLMoniker
RegisterBindStatusCallback
CoInternetParseUrl
wininet
FindCloseUrlCache
GetUrlCacheConfigInfoA
CreateUrlCacheContainerA
InternetCreateUrlW
FindNextUrlCacheEntryW
InternetGetConnectedStateExW
InternetCrackUrlW
InternetCombineUrlW
DeleteUrlCacheEntryW
FindFirstUrlCacheEntryW
GetUrlCacheEntryInfoW
UnlockUrlCacheEntryStream
ReadUrlCacheEntryStream
RetrieveUrlCacheEntryStreamW
CommitUrlCacheEntryW
CreateUrlCacheEntryW
InternetQueryOptionW
shell32
ord155
SHGetDesktopFolder
ord25
winspool.drv
ClosePrinter
DeviceCapabilitiesW
DocumentPropertiesW
GetPrinterW
OpenPrinterW
DocumentPropertiesA
GetPrinterA
OpenPrinterA
Exports
Exports
DllCanUnloadNow
DllEnumClassObjects
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 155KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ