msADOX.pdb
Static task
static1
Behavioral task
behavioral1
Sample
73e25607e2d8b0d195eb4a0dcdd9f476_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
73e25607e2d8b0d195eb4a0dcdd9f476_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
73e25607e2d8b0d195eb4a0dcdd9f476_JaffaCakes118
-
Size
268KB
-
MD5
73e25607e2d8b0d195eb4a0dcdd9f476
-
SHA1
f42097b3be65d97f975c79411b2542cf3096723c
-
SHA256
3e063d89472a81da2a1025700e9f0bca83acdbdc7446018ccf5822ca413ef396
-
SHA512
9c90a4bfb64b141aece8f527d50246c6bcf9cca624451fe1e743572b9cbbf1d14e31d52bd696b5e83b73e9218c04af05e5aa8319cdfdcce4ae351bcbc715a45e
-
SSDEEP
6144:T12lGEAe9lVrRZgZGN0ZzD3Xn6/+magVWL:h2lGEAe9lnZgbD3Lmagi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 73e25607e2d8b0d195eb4a0dcdd9f476_JaffaCakes118
Files
-
73e25607e2d8b0d195eb4a0dcdd9f476_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
7853305a8d36f561c76ecbd4b2f0ea2b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_adjust_fdiv
_except_handler3
wcscat
wcscpy
wcstod
wcschr
_wcsicmp
wcslen
_wcsnicmp
memmove
swprintf
sprintf
malloc
_onexit
__dllonexit
_purecall
_initterm
free
msdart
lstrcatI
RegEnumKeyExI
lstrlenI
RegSetValueExI
RegCreateKeyExI
RegQueryValueExI
RegDeleteKeyI
lstrcpyI
PostMessageI
RegOpenKeyExI
MpHeapAlloc
LoadStringI
GetWindowsDirectoryI
CharNextI
GetVersionExI
_LoadVersionedResourceEx@16
??1CReaderWriterLock3@@QAE@XZ
??0CReaderWriterLock3@@QAE@XZ
?WriteLock@CReaderWriterLock3@@QAEXXZ
?WriteUnlock@CReaderWriterLock3@@QAEXXZ
?ReadOrWriteLock@CReaderWriterLock3@@QAE_NXZ
?ReadOrWriteUnlock@CReaderWriterLock3@@QAEX_N@Z
GetModuleHandleI
GetModuleFileNameI
UMSEnterCSWraper
LoadLibraryI
FXMemAttach
MpGetHeapHandle
MpHeapFree
MPInitializeCriticalSection
MPDeleteCriticalSection
FXMemDetach
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
EnterCriticalSection
CompareStringW
LCMapStringW
LCMapStringA
CompareStringA
DeleteCriticalSection
InitializeCriticalSection
HeapDestroy
GetCurrentProcess
CloseHandle
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcessId
GetUserDefaultLCID
TlsFree
TlsAlloc
lstrlenW
GetCurrentThreadId
TlsGetValue
TlsSetValue
InterlockedExchange
LeaveCriticalSection
IsBadCodePtr
InterlockedIncrement
InterlockedDecrement
DisableThreadLibraryCalls
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
advapi32
RegCloseKey
ole32
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoCreateInstance
oleaut32
VariantInit
SetErrorInfo
VariantChangeType
VariantClear
GetErrorInfo
LoadRegTypeLi
SysStringLen
SafeArrayPutElement
SafeArrayGetElement
VariantCopy
SysAllocString
LoadTypeLi
OaBuildVersion
SysAllocStringLen
CreateErrorInfo
SafeArrayDestroy
SafeArrayCreate
SafeArrayUnlock
SafeArrayCopy
RegisterTypeLi
SysFreeString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 144KB - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sdbid Size: 4KB - Virtual size: 468B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rmnet Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE