e:\FF\build_system\non_templates\JS_Hijack\Release\JS_Hijack.pdb
Static task
static1
Behavioral task
behavioral1
Sample
66e1e12fd6c998456d422a5add7cf02a_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
66e1e12fd6c998456d422a5add7cf02a_JaffaCakes118
-
Size
205KB
-
MD5
66e1e12fd6c998456d422a5add7cf02a
-
SHA1
9aad187b14dece2bc5ffdf96ea03862d0e584bff
-
SHA256
ccca0acee2735d6cc9792674c2c44616e7aef4675902f3c8d963a811d4961099
-
SHA512
cb291f4303fdfed8ac3618b48c22243d294fa557b43b3937689a5ba072625610a29691234aeed4f2f61d382bf0370d30e40842df9c693fd4e17e413ba0c1d364
-
SSDEEP
3072:UYo8OhQ8sCIIvv7aEPgGd4aL31PgFboeMatJiK8v8DaJ/83FZN95610h:MdRPgFboCTlaJE1Lq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 66e1e12fd6c998456d422a5add7cf02a_JaffaCakes118
Files
-
66e1e12fd6c998456d422a5add7cf02a_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
c7be21027dbd52451943bda528c26cea
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FindResourceA
FindResourceExA
GetLastError
GetProcAddress
GetModuleHandleA
lstrlenA
lstrcmpiA
InterlockedIncrement
InterlockedDecrement
IsDBCSLeadByte
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
LoadResource
LoadLibraryExA
GetModuleHandleW
SetThreadLocale
GetThreadLocale
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
CompareStringW
CompareStringA
FlushFileBuffers
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
FreeLibrary
MultiByteToWideChar
CloseHandle
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryA
InterlockedExchange
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
GetCurrentThreadId
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
FatalAppExitA
VirtualFree
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEnvironmentVariableA
user32
CharNextW
CharNextA
advapi32
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
ole32
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
oleaut32
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
LoadRegTypeLi
DispCallFunc
SysStringLen
VariantInit
VarUI4FromStr
SysAllocString
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
VariantClear
SysFreeString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 155KB - Virtual size: 155KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ