D:\RnD\Client\IE\Dev\6.0.3\Setup\AutomaticUpdate\Release\AutomaticUpdate.pdb
Static task
static1
Behavioral task
behavioral1
Sample
84ff960a06296c3f57b93ddedcaf60eb_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
84ff960a06296c3f57b93ddedcaf60eb_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
84ff960a06296c3f57b93ddedcaf60eb_JaffaCakes118
-
Size
450KB
-
MD5
84ff960a06296c3f57b93ddedcaf60eb
-
SHA1
b73228300e3513394de222b5783f79a5d835f71e
-
SHA256
17ca749587453b8ef35112561be160c6e0c16812046d6f1a3f9429b3d35f3c53
-
SHA512
248e62e1c9617274d44b296c6379c87f74abad717d6c15d4f78838a16d63db5be8ff8456efb855e326726ce89de373041468a0c505849e5ecc10200cd832786e
-
SSDEEP
12288:2ZefePwyc0apktrdoGFUA/OMpTkV1QpqtqOv:JewL0apUjFUA/FpTrqtp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 84ff960a06296c3f57b93ddedcaf60eb_JaffaCakes118
Files
-
84ff960a06296c3f57b93ddedcaf60eb_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
ee5b9eb5900779375c903d3b8aff4574
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LocalAlloc
LocalFree
GetCurrentProcessId
OpenProcess
TerminateProcess
GetCurrentProcess
GetTickCount
GetVersionExA
DeleteFileW
GetModuleHandleW
GetModuleFileNameW
GetLongPathNameW
GetModuleHandleA
GetComputerNameW
MultiByteToWideChar
WideCharToMultiByte
GetSystemTimeAsFileTime
CreateFileW
ReadFile
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
TlsAlloc
TlsSetValue
TlsGetValue
SetFilePointer
WriteFile
LoadLibraryA
GetLocalTime
GetCommandLineA
HeapAlloc
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
GetConsoleCP
GetConsoleMode
GetFileType
RaiseException
RtlUnwind
TlsFree
InterlockedIncrement
SetLastError
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
FlushFileBuffers
LCMapStringA
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
CreateFileA
CloseHandle
LockResource
GetProcAddress
GetLastError
SizeofResource
LoadLibraryW
OutputDebugStringW
WaitForSingleObject
CreateProcessW
LoadResource
FreeLibrary
FindResourceW
shlwapi
PathFileExistsW
PathFindFileNameW
user32
IsWindowVisible
RegisterWindowMessageW
PostMessageA
IsWindow
SendMessageA
advapi32
RegOpenKeyExW
OpenProcessToken
GetTokenInformation
RegEnumKeyExW
GetSidSubAuthority
GetSidSubAuthorityCount
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
GetUserNameW
shell32
SHCreateDirectoryExW
SHGetFolderPathW
ole32
CoTaskMemFree
Exports
Exports
DllOnUpdateFinish
DllRegisterServer
Sections
.text Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ