xpshims.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ae6aa9c161799aac9b4fb94098a5d87f_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ae6aa9c161799aac9b4fb94098a5d87f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ae6aa9c161799aac9b4fb94098a5d87f_JaffaCakes118
-
Size
176KB
-
MD5
ae6aa9c161799aac9b4fb94098a5d87f
-
SHA1
25a80d39981604ba7e6256f26ef823b92c3594d6
-
SHA256
537572e977d444ce37e67648d3ddf74308bff2a6ed2e8278a0eeaba3ce3bfd63
-
SHA512
0126c4136cb34a7837aa3759e3274b721dee04eba38ba11aacd3c5394fd18c222cf3cf3675724f34be320ecb00a4b08aba0f38ac4809c9e3c0e00e666dd0ceb1
-
SSDEEP
3072:NoesGKyHx5tN54ehaC4u456GzNuryoqCTinzpoSJFFsd2p9wrfudBBdVHh2ttnxu:JsGZn544T4HzAOp+iN5ad2QrfuLpcth
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae6aa9c161799aac9b4fb94098a5d87f_JaffaCakes118
Files
-
ae6aa9c161799aac9b4fb94098a5d87f_JaffaCakes118.dll windows:6 windows x86 arch:x86
47ee7012c872237fb8a7380517fbd8c0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
ntdll
NtQueryObject
RtlUnwind
kernel32
QueryPerformanceCounter
GetCurrentProcessId
GetProcAddress
VirtualProtect
VirtualQuery
GetCurrentThreadId
GetModuleHandleExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleA
InterlockedCompareExchange
Sleep
InterlockedExchange
LoadLibraryExW
WaitForSingleObject
user32
FindWindowExA
GetClassNameW
GetWindowThreadProcessId
SetWindowsHookExW
shlwapi
ord157
ord158
ord156
iertutil
ord305
Exports
Exports
IEShims_Initialize
IEShims_Uninitialize
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 165KB - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ