admparse.pdb
Static task
static1
Behavioral task
behavioral1
Sample
93e6b36749e8408aae8f4188122de7b9_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
93e6b36749e8408aae8f4188122de7b9_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
93e6b36749e8408aae8f4188122de7b9_JaffaCakes118
-
Size
71KB
-
MD5
93e6b36749e8408aae8f4188122de7b9
-
SHA1
f726ce59cec21658b538640ad4185a0fcf9027ed
-
SHA256
2e2e9365ab814edf7fd0b8fcc042aedc2f9026c27fbe5dc92c3d233538cbefe2
-
SHA512
330dddf32301e7672a2f96925d254ba0aa67a9c390226af4b22204bf7d790768a8e96779ac13c0adeb72d357506f1bd79d8824ce6491911a044f745122333ada
-
SSDEEP
1536:Mea5h8pgiEaMHHO7p1IJ7yEDKeBHln9AGNzvYE:j0hOgSMHu7e7LDxBFn99pvP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 93e6b36749e8408aae8f4188122de7b9_JaffaCakes118
Files
-
93e6b36749e8408aae8f4188122de7b9_JaffaCakes118.dll windows:6 windows x86 arch:x86
b0d8ba8bad83df3fe1eb9aaa9018d77a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
_CxxThrowException
??1type_info@@UAE@XZ
bsearch
_wcsnicmp
_wcsicmp
wcsncmp
memset
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
_vsnwprintf
kernel32
ReadFile
WritePrivateProfileSectionW
WritePrivateProfileSectionA
GetPrivateProfileSectionW
GetPrivateProfileSectionA
GetPrivateProfileStringW
GetFileAttributesW
HeapFree
LocalFree
GetProcessHeap
CompareStringW
HeapReAlloc
HeapAlloc
lstrlenW
CloseHandle
LocalAlloc
GetFileSize
CreateFileW
SetLastError
FormatMessageW
lstrcmpW
GetModuleFileNameW
GetVersionExW
DeleteCriticalSection
DeleteAtom
FindAtomA
InitializeCriticalSection
DisableThreadLibraryCalls
LeaveCriticalSection
EnterCriticalSection
GlobalFree
lstrlenA
GlobalAlloc
AddAtomA
WriteFile
SetFilePointer
lstrcmpiW
InterlockedDecrement
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetPrivateProfileStringA
WideCharToMultiByte
GetLastError
MultiByteToWideChar
SearchPathW
FindResourceW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
UnmapViewOfFile
FreeLibrary
GetLocaleInfoW
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
FindResourceExW
LoadResource
WritePrivateProfileStringW
user32
SendMessageW
DestroyWindow
LoadCursorW
RegisterClassA
CreateWindowExA
GetWindowLongW
DefWindowProcW
SetScrollPos
SetWindowLongW
GetClientRect
LoadStringW
SetScrollRange
ShowWindow
UnregisterClassA
SetWindowTextW
EndDialog
SetDlgItemTextW
MessageBoxW
GetDlgItemTextW
EnableWindow
GetDlgItem
CallWindowProcW
DialogBoxParamW
GetWindowTextW
GetWindowRect
GetParent
ReleaseDC
GetDC
GetScrollInfo
CreateWindowExW
SetWindowPos
DrawTextW
MoveWindow
gdi32
GetDeviceCaps
DeleteObject
SelectObject
CreateFontIndirectW
GetTextExtentPoint32W
GetTextMetricsW
GetStockObject
shlwapi
PathFindFileNameW
StrCmpW
StrRChrW
StrCSpnW
StrSpnW
StrCmpNW
StrDupW
StrToIntW
StrCmpIW
ord295
ord215
ord217
ord437
oleaut32
SysStringLen
VariantClear
VariantInit
SysFreeString
SysAllocString
ole32
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
comctl32
ord16
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
Exports
Exports
AdmClose
AdmFinishedA
AdmFinishedW
AdmInitA
AdmInitW
AdmResetA
AdmResetW
AdmSaveData
CheckDuplicateKeysA
CheckDuplicateKeysW
CreateAdmUiA
CreateAdmUiW
DllMain
GetAdmCategoriesA
GetAdmCategoriesW
GetFontInfoA
GetFontInfoW
IsAdmDirty
ResetAdmDirtyFlag
Sections
.text Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ