blackbox_notestroot.pdb
Static task
static1
Behavioral task
behavioral1
Sample
67ca12aded9c52cb0b082115a56cacb7_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
67ca12aded9c52cb0b082115a56cacb7_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
67ca12aded9c52cb0b082115a56cacb7_JaffaCakes118
-
Size
628KB
-
MD5
67ca12aded9c52cb0b082115a56cacb7
-
SHA1
227bc17efa54edada9f4d102c18b6383c2145d9d
-
SHA256
08e572a87c7813efbef25e9f9a324eab9b81c1df2eae68c7140ddfe55cd88e53
-
SHA512
9c24b1ec8c4fab0233042cbc0402b85e34a321e332611497c1bf7f12f26ae7bfbd361137e091ff86b51ca548ff0262094f62a71044e964c2cc6554e92ead52a2
-
SSDEEP
12288:aXN+j2hor0tDRNtIuH0of9WTUKsbqbGkMME23:aXXhc0t17IuH0ofSUKsbIM323
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 67ca12aded9c52cb0b082115a56cacb7_JaffaCakes118
Files
-
67ca12aded9c52cb0b082115a56cacb7_JaffaCakes118.dll regsvr32 windows:6 windows x86 arch:x86
8cbe381d2dc956d4a2eeaa4e4cb8faec
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
iswctype
malloc
free
wcsrchr
_wcsnicmp
_vsnwprintf
_errno
_vsnprintf
wcsncmp
atol
_wcsicmp
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
strrchr
memmove
_purecall
ntdll
RtlUnwind
advapi32
GetSecurityDescriptorDacl
CreatePrivateObjectSecurityEx
GetNamedSecurityInfoW
SetNamedSecurityInfoW
GetSecurityDescriptorSacl
DestroyPrivateObjectSecurity
RegSetKeySecurity
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
OpenProcessToken
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegDeleteValueW
mfplat
MFHeapFree
MFHeapAlloc
kernel32
ExpandEnvironmentStringsW
GetWindowsDirectoryW
GetSystemDirectoryW
LoadLibraryW
SetFileAttributesW
GetFileAttributesW
LocalFree
GetCurrentThread
GetVersion
GetSystemTime
FreeLibrary
SetFilePointer
FindClose
GetProcessAffinityMask
CreateThread
SetThreadAffinityMask
SetThreadPriority
ResumeThread
WaitForSingleObject
GetSystemInfo
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
LoadLibraryA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
CreateFileMappingW
RemoveDirectoryW
FindNextFileW
FindFirstFileW
CreateDirectoryW
MultiByteToWideChar
OutputDebugStringA
TerminateProcess
SetUnhandledExceptionFilter
UnmapViewOfFile
MapViewOfFile
LocalAlloc
GetSystemTimeAsFileTime
InterlockedCompareExchange
SetLastError
ExitProcess
WideCharToMultiByte
DisableThreadLibraryCalls
GetLocalTime
QueryPerformanceCounter
GlobalMemoryStatus
InterlockedIncrement
InterlockedDecrement
HeapFree
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
GetProcAddress
GetModuleHandleA
CloseHandle
CreateFileA
UnhandledExceptionFilter
GetLastError
GetModuleFileNameA
HeapAlloc
Sleep
GetDiskFreeSpaceA
WriteFile
GetCurrentProcess
GetFileSize
CopyFileW
DeleteFileW
MoveFileW
GetTempFileNameW
GetTempPathW
ReadFile
CreateFileW
InterlockedExchange
GetModuleHandleW
DeviceIoControl
FreeEnvironmentStringsA
FreeEnvironmentStringsW
lstrlenA
lstrlenW
GetEnvironmentStrings
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
ole32
CoTaskMemFree
StringFromCLSID
CLSIDFromString
CoTaskMemAlloc
CoCreateGuid
wintrust
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
Exports
Exports
DllMain
DllRegisterServer
DllUnregisterServer
IBlackBox_CreateInstance
IBlackBox_CreateInstance2
IBlackBox_CreateInstanceEx
IBlackBox_CreateInstanceEx2
IBlackBox_DestroyInstance
Sections
.text Size: 458KB - Virtual size: 458KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ