DBmsrpcn.pdb
Static task
static1
Behavioral task
behavioral1
Sample
94405e3787d26f53f9d812ec5d088314_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
94405e3787d26f53f9d812ec5d088314_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
94405e3787d26f53f9d812ec5d088314_JaffaCakes118
-
Size
192KB
-
MD5
94405e3787d26f53f9d812ec5d088314
-
SHA1
26c3fe2536fb10d760e08b279b3721717edf052a
-
SHA256
fdfed444b9a0e6e26696f067f8350b972f7d1cb99914140bb65755de8e7a88d2
-
SHA512
f2e5f4e9107bcd5523482ea620d81efd996343b6abe99e2b654516fbef6b3fbb1834a5783974adba2d16022440a2defa8bb09317c33607e7bc0280611a39d021
-
SSDEEP
3072:+edqK4RUjrWx6+MjZo6VipJCjhf6J7o2SJeJrUh/Z21eLacj6qFGQN+AVh3hefdU:+edqcjH+MDVGQUJ7VJwh/Z21AVj6qpV+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 94405e3787d26f53f9d812ec5d088314_JaffaCakes118
Files
-
94405e3787d26f53f9d812ec5d088314_JaffaCakes118.dll windows:5 windows x86 arch:x86
aaf2f001fda797fb172abb2f7958b63d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_adjust_fdiv
_initterm
getenv
_stricmp
strncpy
_strnicmp
strchr
free
malloc
_snprintf
sprintf
_except_handler3
kernel32
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
QueryPerformanceCounter
GetCurrentThreadId
GetTickCount
SetUnhandledExceptionFilter
Sleep
MultiByteToWideChar
GetLastError
GetComputerNameA
WideCharToMultiByte
UnhandledExceptionFilter
advapi32
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
rpcrt4
RpcBindingSetAuthInfoA
RpcEpResolveBinding
RpcBindingFromStringBindingA
RpcNetworkIsProtseqValidA
NdrClientCall2
RpcBindingFree
Exports
Exports
ConnectionCheckForData
ConnectionClose
ConnectionError
ConnectionErrorW
ConnectionMode
ConnectionObjectSize
ConnectionOpen
ConnectionOpenW
ConnectionRead
ConnectionServerEnum
ConnectionServerEnumW
ConnectionStatus
ConnectionTransact
ConnectionVer
ConnectionWrite
ConnectionWriteOOB
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 172KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ