triedit.pdb
Static task
static1
Behavioral task
behavioral1
Sample
891315a1a7fc025e371912287497a00f_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
891315a1a7fc025e371912287497a00f_JaffaCakes118
-
Size
256KB
-
MD5
891315a1a7fc025e371912287497a00f
-
SHA1
8cc1de0e002aa4fae84dcb7a6428c4c533439515
-
SHA256
51f04dc54c724e8615a0ca4ad62b396bb3d1bf8e15c8b67bbce1a75bf2a0ed16
-
SHA512
de1417ae440b98cdb3a0e531672c6f88d2b34552dd5e00b0939dd4c7d9740b249a28fda25164531a1cc0418f3337d2f5d489b3cbdf5bf8fce57be5c8a7ecd37a
-
SSDEEP
3072:20lkETiKDVLhW9Yi58gh5GocoRkzvxz4dqCQ+fiTZ+K33Vk/GT58gG08m7Y5Pd1u:h3lMYa5GikSdqChqTzVk/u5pKKunO5X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 891315a1a7fc025e371912287497a00f_JaffaCakes118
Files
-
891315a1a7fc025e371912287497a00f_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
6e43dd50ce21fc52aa2cec80f9d0f93a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_wcsrev
wcslen
_wcsnicmp
??2@YAPAXI@Z
wcsstr
wcstok
iswspace
_wcslwr
wcschr
wcspbrk
wcsrchr
memmove
wcsncpy
wcscpy
_itow
iswupper
_wcsupr
wcsncmp
_adjust_fdiv
_initterm
qsort
??3@YAXPAX@Z
free
realloc
malloc
wcstoul
wcscat
iswdigit
_wcsicmp
time
srand
rand
_wtoi
_purecall
oleaut32
VariantClear
VariantChangeTypeEx
VariantInit
VariantCopy
SysAllocString
SysFreeString
SysStringLen
SysAllocStringLen
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
VariantChangeType
LoadRegTypeLi
SetErrorInfo
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
VarI4FromStr
ole32
CoTaskMemRealloc
CoTaskMemAlloc
OleRegGetUserType
StringFromCLSID
CoTaskMemFree
CreateStreamOnHGlobal
GetHGlobalFromStream
CoCreateInstance
kernel32
GetCurrentProcess
HeapDestroy
DisableThreadLibraryCalls
FreeLibrary
SizeofResource
LoadResource
GetVersionExA
FindResourceA
FindResourceW
GetModuleFileNameA
GetModuleFileNameW
LoadLibraryExA
LoadLibraryExW
lstrcmpiA
lstrcmpiW
lstrcmpA
lstrcmpW
lstrcpynW
IsBadWritePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
GetLastError
MultiByteToWideChar
GlobalSize
GlobalAlloc
GlobalReAlloc
GlobalLock
GlobalUnlock
GlobalFree
SetLastError
gdi32
CreatePatternBrush
DeleteObject
SelectObject
SetWindowOrgEx
PatBlt
user32
SetRect
InvalidateRect
InflateRect
SetCursor
GetKeyState
ReleaseDC
GetDC
PtInRect
GetClientRect
ScreenToClient
SetFocus
IsWindow
GetParent
GetWindowLongA
GetWindowLongW
IsCharAlphaNumericA
IsCharAlphaNumericW
IsCharAlphaA
IsCharAlphaW
LoadBitmapA
LoadBitmapW
LoadCursorA
LoadCursorW
LoadStringA
LoadStringW
CharNextW
advapi32
RegEnumKeyExW
RegEnumKeyExA
RegQueryValueExW
RegQueryValueExA
RegSetValueExW
RegSetValueExA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyExA
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 123KB - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 106KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE