adsldpc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
83dfbcf8d9a903dabb8c9a4397c5421b_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
83dfbcf8d9a903dabb8c9a4397c5421b_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
83dfbcf8d9a903dabb8c9a4397c5421b_JaffaCakes118
-
Size
140KB
-
MD5
83dfbcf8d9a903dabb8c9a4397c5421b
-
SHA1
9e2663cace71aef2208253f26a046b716c733c95
-
SHA256
9356f90bad064e76c589a5c43f7d1eba94fd59e224a7245ff340c882ebdc264c
-
SHA512
686126402fe2a29ca49213d35412122a562316cb7825571481f612c02fcec18d989efdc78180964262fc03cee4beef71d0234e69db919667574b2b97935872c9
-
SSDEEP
3072:1WsstoNeG5s+uY76iJHUpub88ZlZ8srp9KoXwxoLLfk:ksWoP5KY7lAx/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 83dfbcf8d9a903dabb8c9a4397c5421b_JaffaCakes118
Files
-
83dfbcf8d9a903dabb8c9a4397c5421b_JaffaCakes118.dll windows:5 windows x86 arch:x86
767f92df2cc6097f9e14b31a7ae17676
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
bsearch
_except_handler3
wcscpy
wcslen
wcsncpy
_wcsicmp
wcschr
swscanf
_wtol
wcscmp
wcstoul
_itow
swprintf
wcscat
_adjust_fdiv
malloc
_initterm
free
qsort
_wcsnicmp
wcsstr
wcsrchr
wcsncat
iswdigit
_wtoi
ntdll
RtlInitUnicodeString
netapi32
NetWkstaGetInfo
NetApiBufferFree
wldap32
ord13
ord10
ord41
ord36
ord167
ord224
ord79
ord18
ord203
ord194
ord16
ord206
ord134
ord135
ord138
ord191
ord116
ord100
ord173
ord319
ord321
ord179
ord91
ord88
ord145
ord219
ord210
ord208
ord54
ord157
ord155
ord165
ord188
ord161
ord69
ord65
ord113
ord111
ord85
ord40
ord26
ord27
ord127
ord97
ord140
ord77
ord142
ord133
ord73
ord216
ord29
ord53
ord300
ord311
ord301
ord94
ord12
ord120
ord147
ord146
ord304
ord310
ord190
ord309
ord14
advapi32
RegCreateKeyExW
OpenThreadToken
OpenProcessToken
LsaFreeMemory
LsaGetUserName
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
GetSidLengthRequired
SystemFunction040
SystemFunction041
RegSetValueExW
user32
LoadStringW
wsprintfW
kernel32
MultiByteToWideChar
InitializeCriticalSection
FreeLibrary
DeleteCriticalSection
CompareStringW
GetProcAddress
LoadLibraryW
GetLastError
GetCurrentThread
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
LocalFree
LocalAlloc
GetCurrentProcessId
GetCurrentProcess
CloseHandle
GetTickCount
FileTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
ReadFile
GetFileSize
CreateFileW
WriteFile
DeleteFileW
CreateDirectoryW
ExpandEnvironmentStringsW
lstrlenW
CompareFileTime
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
Exports
Exports
??0CLexer@@QAE@PAG@Z
??1CLexer@@QAE@XZ
?GetNextToken@CLexer@@QAEJPAGPAK@Z
?SetAtDisabler@CLexer@@QAEXH@Z
?SetExclaimnationDisabler@CLexer@@QAEXH@Z
?SetFSlashDisabler@CLexer@@QAEXH@Z
ADSIAbandonSearch
ADSICloseDSObject
ADSICloseSearchHandle
ADSICreateDSObject
ADSIDeleteDSObject
ADSIExecuteSearch
ADSIFreeColumn
ADSIGetColumn
ADSIGetFirstRow
ADSIGetNextColumnName
ADSIGetNextRow
ADSIGetObjectAttributes
ADSIGetPreviousRow
ADSIModifyRdn
ADSIOpenDSObject
ADSISetObjectAttributes
ADSISetSearchPreference
ADsAbandonSearch
ADsCloseSearchHandle
ADsCreateAttributeDefinition
ADsCreateClassDefinition
ADsCreateDSObject
ADsCreateDSObjectExt
ADsDecodeBinaryData
ADsDeleteAttributeDefinition
ADsDeleteClassDefinition
ADsDeleteDSObject
ADsEncodeBinaryData
ADsEnumAttributes
ADsEnumClasses
ADsExecuteSearch
ADsFreeColumn
ADsGetColumn
ADsGetFirstRow
ADsGetLastError
ADsGetNextColumnName
ADsGetNextRow
ADsGetObjectAttributes
ADsGetPreviousRow
ADsHelperGetCurrentRowMessage
ADsObject
ADsSetLastError
ADsSetObjectAttributes
ADsSetSearchPreference
ADsWriteAttributeDefinition
ADsWriteClassDefinition
AdsTypeFreeAdsObjects
AdsTypeToLdapTypeCopyConstruct
AdsTypeToLdapTypeCopyDNWithBinary
AdsTypeToLdapTypeCopyDNWithString
AdsTypeToLdapTypeCopyGeneralizedTime
AdsTypeToLdapTypeCopyTime
AllocADsMem
AllocADsStr
BerBvFree
BuildADsParentPath
BuildADsParentPathFromObjectInfo
BuildADsParentPathFromObjectInfo2
BuildADsPathFromLDAPPath
BuildADsPathFromLDAPPath2
BuildADsPathFromParent
BuildLDAPPathFromADsPath
BuildLDAPPathFromADsPath2
ChangeSeparator
Component
ConvertSidToString
ConvertSidToU2Trustee
ConvertU2TrusteeToSid
FindEntryInSearchTable
FindSearchTableIndex
FreeADsMem
FreeADsStr
FreeObjectInfo
GetDefaultServer
GetDisplayName
GetDomainDNSNameForDomain
GetLDAPTypeName
GetSyntaxOfAttribute
InitObjectInfo
IsGCNamespace
LdapAddExtS
LdapAddS
LdapAttributeFree
LdapCacheAddRef
LdapCloseObject
LdapCompareExt
LdapControlFree
LdapControlsFree
LdapCountEntries
LdapCrackUserDNtoNTLMUser
LdapCrackUserDNtoNTLMUser2
LdapCreatePageControl
LdapDeleteExtS
LdapDeleteS
LdapFirstAttribute
LdapFirstEntry
LdapGetDn
LdapGetNextPageS
LdapGetSchemaObjectCount
LdapGetSubSchemaSubEntryPath
LdapGetSyntaxIdOfAttribute
LdapGetSyntaxOfAttributeOnServer
LdapGetValues
LdapGetValuesLen
LdapInitializeSearchPreferences
LdapIsClassNameValidOnServer
LdapMakeSchemaCacheObsolete
LdapMemFree
LdapModDnS
LdapModifyExtS
LdapModifyS
LdapMsgFree
LdapNextAttribute
LdapNextEntry
LdapOpenObject
LdapOpenObject2
LdapParsePageControl
LdapParseResult
LdapReadAttribute
LdapReadAttribute2
LdapReadAttributeFast
LdapRenameExtS
LdapResult
LdapSearch
LdapSearchAbandonPage
LdapSearchExtS
LdapSearchInitPage
LdapSearchS
LdapSearchST
LdapTypeBinaryToString
LdapTypeCopyConstruct
LdapTypeFreeLdapModList
LdapTypeFreeLdapModObject
LdapTypeFreeLdapObjects
LdapTypeToAdsTypeCopyConstruct
LdapTypeToAdsTypeDNWithBinary
LdapTypeToAdsTypeDNWithString
LdapTypeToAdsTypeGeneralizedTime
LdapTypeToAdsTypeUTCTime
LdapValueFree
LdapValueFreeLen
LdapcKeepHandleAround
LdapcSetStickyServer
MapADSTypeToLDAPType
MapLDAPTypeToADSType
PathName
ReadPagingSupportedAttr
ReadSecurityDescriptorControlType
ReadServerSupportsIsADControl
ReallocADsMem
ReallocADsStr
SchemaAddRef
SchemaClose
SchemaGetClassInfo
SchemaGetClassInfoByIndex
SchemaGetObjectCount
SchemaGetPropertyInfo
SchemaGetPropertyInfoByIndex
SchemaGetStringsFromStringTable
SchemaGetSyntaxOfAttribute
SchemaIsClassAContainer
SchemaOpen
SortAndRemoveDuplicateOIDs
UnMarshallLDAPToLDAPSynID
intcmp
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ