netjoin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a7ee8817acf3dd58d36fefc1d7744041_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a7ee8817acf3dd58d36fefc1d7744041_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a7ee8817acf3dd58d36fefc1d7744041_JaffaCakes118
-
Size
214KB
-
MD5
a7ee8817acf3dd58d36fefc1d7744041
-
SHA1
34621d4992933e08b21f3e30d983f346d412b49a
-
SHA256
ba2cb627e17e04daffbdbbb26ed314f50b472420dda21523860f4624f45580c2
-
SHA512
d06a42e6c16ce199a1d9b473fbc040666aef269ae033b25eac35ec239129461acf2a4ff2f5ce2bf3f7098ddc3cf4129d8ff4bad26914e941795b4087c5e58ba3
-
SSDEEP
3072:TUPjQPZ13P3CinptkFlxGTqliFt1ZO+m1TwZuWbUOcHw3MncRWbb8CYeKMj8CN:TUPjQPcFlI9DOZfMUu3MnAWDYes2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a7ee8817acf3dd58d36fefc1d7744041_JaffaCakes118
Files
-
a7ee8817acf3dd58d36fefc1d7744041_JaffaCakes118.dll windows:6 windows x86 arch:x86
93cf9e5fd04e0b562ef4cab9c3b666e8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
memset
memcpy
_wcsicmp
_vsnwprintf
swscanf_s
_wtol
_wcsupr
_wcslwr
wcschr
_wcsnicmp
wcstoul
toupper
_ltow_s
wcscpy_s
_XcptFilter
malloc
free
_initterm
_amsg_exit
_except_handler4_common
wcscat_s
_ultow
ntdll
RtlCompareUnicodeString
RtlAllocateAndInitializeSid
NtOpenThreadToken
NtClose
RtlFreeSid
RtlValidSid
RtlEqualSid
RtlGetNtProductType
NtQueryLicenseValue
RtlRunDecodeUnicodeString
RtlRunEncodeUnicodeString
RtlUnicodeStringToOemString
RtlFreeOemString
RtlDuplicateUnicodeString
RtlCopySid
RtlDowncaseUnicodeString
RtlLengthSid
RtlInitializeSid
RtlSubAuthoritySid
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
RtlInitUnicodeString
RtlCompareMemory
RtlNtStatusToDosError
RtlFreeHeap
RtlAllocateHeap
RtlImageNtHeader
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-file-l1-1-0
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetFileSize
CreateFileW
GetFileAttributesW
CreateDirectoryW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-interlocked-l1-1-0
InterlockedExchange
InterlockedCompareExchange
api-ms-win-core-libraryloader-l1-1-0
FreeLibrary
GetProcAddress
LoadLibraryExA
DisableThreadLibraryCalls
api-ms-win-core-localregistry-l1-1-0
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegUnLoadKeyW
RegLoadKeyW
RegDeleteKeyExW
api-ms-win-core-misc-l1-1-0
LocalAlloc
GlobalFree
Sleep
LocalFree
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
OpenThreadToken
GetCurrentThread
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
api-ms-win-core-sysinfo-l1-1-0
GetWindowsDirectoryW
GetLocalTime
GetVersionExW
GetSystemTime
GetTickCount
GetSystemTimeAsFileTime
GetComputerNameExW
api-ms-win-security-base-l1-1-0
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
ImpersonateSelf
CheckTokenMembership
AdjustTokenPrivileges
RevertToSelf
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSidToSidW
kernel32
LoadLibraryA
DnsHostnameToComputerNameW
DelayLoadFailureHook
QueryPerformanceCounter
VirtualProtect
VirtualAlloc
GetModuleHandleW
GetSystemInfo
LoadLibraryW
VirtualQuery
GetVersion
GetSystemWindowsDirectoryW
SetComputerNameExW
MoveFileExW
GetComputerNameW
Exports
Exports
NetProvisionComputerAccount
NetRequestOfflineDomainJoin
NetSetuppCloseLog
NetSetuppOpenLog
NetpAvoidNetlogonSpnSet
NetpChangeMachineName
NetpCheckOfflineLsaPolicyUpdate
NetpCompleteOfflineDomainJoin
NetpControlServices
NetpCrackNamesStatus2Win32Error
NetpCreateComputerObjectInDs
NetpDecodeProvisioningBlob
NetpDecodeProvisioningData
NetpDoDomainJoin
NetpDoInitiateOfflineDomainJoin
NetpDomainJoinLicensingCheck
NetpDumpBlobToLog
NetpDumpDcInfoToLog
NetpDumpDnsDomainInfoToLog
NetpEncodeProvisionData
NetpEncodeProvisioningBlob
NetpFreeLdapLsaDomainInfo
NetpFreeODJBlob
NetpGetJoinInformation
NetpGetListOfJoinableOUs
NetpGetLogIndentPrefixString
NetpGetLsaPrimaryDomain
NetpGetMachineAccountName
NetpGetNewMachineName
NetpInitAndPickleBlobWin7
NetpIsSetupInProgress
NetpLogPrintHelper
NetpMachineValidToJoin
NetpManageIPCConnect
NetpManageMachineAccountWithSid
NetpProvisionComputerAccount
NetpQueryService
NetpSeparateUserAndDomain
NetpSetComputerAccountPassword
NetpStopService
NetpStoreInitialDcRecord
NetpUnJoinDomain
NetpUnpickleBlobWin7
NetpUpgradePreNT5JoinInfo
NetpValidateName
Sections
.text Size: 149KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ