cfgbkend.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8e7ce058c36ad96b81ee706414f68bd9_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8e7ce058c36ad96b81ee706414f68bd9_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8e7ce058c36ad96b81ee706414f68bd9_JaffaCakes118
-
Size
210KB
-
MD5
8e7ce058c36ad96b81ee706414f68bd9
-
SHA1
dd7f5813c838c6aaeeeb11258b615b1765c47851
-
SHA256
b76b57093f90e374f075cb4af2bc68b012b6dcfdca9914cc63a00c5f43ed3661
-
SHA512
b3b13d9835e5d41c2ad09bac055f692ca6d6dbb9c4abed02430b7cb191d7e5a22d10add295921bcc8d5b5e061299dff04dfe94d0f52a8815139b52f2322fa379
-
SSDEEP
6144:HnLPy+ETigpqqEMZfe41MHf/2j6lXwY35G7Lpx:Hnbn1/Ke41MmjcwY35Gp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e7ce058c36ad96b81ee706414f68bd9_JaffaCakes118
Files
-
8e7ce058c36ad96b81ee706414f68bd9_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
199037129cb1da4a7bc8b7766907d7d9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
memmove
_waccess
wcschr
_purecall
malloc
??2@YAPAXI@Z
free
??3@YAXPAX@Z
_initterm
_adjust_fdiv
atl
ord16
ord21
ord18
ord22
ord23
ord15
ord32
regapi
RegWdQueryW
RegWinStationCreateW
RegWdEnumerateW
RegCdCreateW
RegWinStationEnumerateW
RegPdEnumerateW
RegPdQueryW
RegWinStationQueryW
RegWinStationDeleteW
RegWinStationQueryEx
winsta
WinStationEnumerateW
WinStationFreeMemory
ServerLicensingClose
ServerLicensingGetPolicy
ServerLicensingOpenW
ServerLicensingGetAvailablePolicyIds
ServerLicensingSetPolicy
_WinStationUpdateSettings
_WinStationReadRegistry
kernel32
lstrcmpiW
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
lstrcpyW
lstrcatW
LocalFree
FreeLibrary
lstrcpynW
LocalAlloc
GetProcAddress
LoadLibraryW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrlenW
GetCurrentProcess
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
GetSystemDirectoryW
GetLastError
user32
LoadStringW
oleaut32
SysFreeString
SysAllocString
ole32
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
advapi32
BuildExplicitAccessWithNameW
BuildSecurityDescriptorW
RegEnumKeyW
GetSecurityDescriptorLength
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
LookupAccountSidW
ConvertSidToStringSidW
GetTrusteeNameW
RegEnumKeyExW
EqualSid
LookupAccountNameW
GetExplicitEntriesFromAclW
BuildTrusteeWithSidW
SetEntriesInAclW
RegDeleteValueW
IsValidSecurityDescriptor
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
GetSecurityDescriptorOwner
RegQueryValueExW
RegSetValueExW
utildll
WinEnumerateDevices
SetupAsyncCdConfig
Exports
Exports
CLSID_CfgComp
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IID_ICfgComp
IID_ISettingsComp
Sections
.text Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ