g:\project\cadi\Src\CTPresetW\Release\CtPresetW.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8e9200d5f59b92bbe700f94ade3eaa26_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8e9200d5f59b92bbe700f94ade3eaa26_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8e9200d5f59b92bbe700f94ade3eaa26_JaffaCakes118
-
Size
380KB
-
MD5
8e9200d5f59b92bbe700f94ade3eaa26
-
SHA1
c5d910d3fa3a3b12d405cc3452f4ae77ad91854b
-
SHA256
6d2c6b67f0c517679ca418d4e2a8a3349caf4c470d59ac668c75d1ba72d0b605
-
SHA512
c2c6a39a7dd4417027509bcd28db18f81406b111c2d92017237ee4a6012b433676bcad637365e361459381090c95d517a68a1a2abedc2664e8d7b009b9416cab
-
SSDEEP
3072:ApJ2Miokl+TI4u38zAuNfgrDy7JTjSvi2UV70tdevWAg0FuQPZy7358t5jx:w1gCK9qfgrDyJ/SvjUViAOL8D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e9200d5f59b92bbe700f94ade3eaa26_JaffaCakes118
Files
-
8e9200d5f59b92bbe700f94ade3eaa26_JaffaCakes118.dll regsvr32 windows:4 windows x86 arch:x86
41d042b847ecb06ed1b92806b0dc5e47
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
lstrlenA
SetThreadLocale
GetThreadLocale
GetProcAddress
LoadLibraryW
GetVersionExA
LeaveCriticalSection
GetACP
GetLocaleInfoA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
CreateFileA
EnterCriticalSection
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
FreeLibrary
lstrcmpiW
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetModuleFileNameW
GetLastError
CopyFileW
InterlockedExchange
lstrlenW
ReadFile
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetStringTypeW
GetStringTypeA
LoadLibraryA
RtlUnwind
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
CloseHandle
GetModuleHandleA
VirtualFree
VirtualAlloc
HeapCreate
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCPInfo
GetOEMCP
LCMapStringA
WideCharToMultiByte
LCMapStringW
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
CreateFileW
user32
UnregisterClassA
CharNextW
advapi32
RegCreateKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyW
RegEnumKeyW
RegQueryValueExW
RegCloseKey
SetNamedSecurityInfoW
ole32
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
shell32
SHGetFolderPathW
SHCreateDirectoryExW
oleaut32
UnRegisterTypeLi
SysAllocString
LoadTypeLi
LoadRegTypeLi
SysStringLen
VarUI4FromStr
SysFreeString
RegisterTypeLi
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 248KB - Virtual size: 247KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 64KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ