d:\td\tao96\tao96\Release\tao96.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a0c103bb46240e5d7405bdcbea14af57_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
a0c103bb46240e5d7405bdcbea14af57_JaffaCakes118
-
Size
202KB
-
MD5
a0c103bb46240e5d7405bdcbea14af57
-
SHA1
f61e9bb18e12f3ec035de8dfde646efe60175c1c
-
SHA256
989f7281b5a6344ca66c69af29dfca69e3f1683afbaf12e03da201e7e41548ec
-
SHA512
ee56c6bd65440ce073d7823e8288d8d33d61d37c51878043235d63b0648b05175524d79ba19253e1425cb44cec561fd549f9e5ff7800c007dbeec25d0138c74b
-
SSDEEP
3072:nz/lzdYhCjYaKbfUaTYWhknKbaP5Y3RwCA3mk6tbJcgcoMFhx4bixw/jV/yS:nvYQkTY0knK+cl9k6nAoM/WW0x/yS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0c103bb46240e5d7405bdcbea14af57_JaffaCakes118
Files
-
a0c103bb46240e5d7405bdcbea14af57_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
00bccb441b2c5d5f2b8e8edfcfed0984
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LeaveCriticalSection
GetLastError
GetProcAddress
GetModuleHandleA
lstrlenA
lstrcmpiA
GetModuleFileNameA
GetModuleHandleW
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
EnterCriticalSection
LoadLibraryA
CloseHandle
WaitForSingleObject
CreateProcessA
CreateMutexA
GetLocalTime
SetThreadLocale
GetThreadLocale
HeapFree
GetProcessHeap
FlushFileBuffers
CreateFileA
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
GetWindowsDirectoryA
RaiseException
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
ReadFile
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
HeapAlloc
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCurrentThreadId
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LCMapStringA
LCMapStringW
VirtualFree
HeapReAlloc
HeapCreate
HeapDestroy
WriteFile
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
user32
CharNextA
CharNextW
IsCharAlphaNumericA
advapi32
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
ole32
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
oleaut32
VariantClear
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysFreeString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 91KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ