triedit.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b3582149bc7d1b5441d54d505329c314_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b3582149bc7d1b5441d54d505329c314_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b3582149bc7d1b5441d54d505329c314_JaffaCakes118
-
Size
155KB
-
MD5
b3582149bc7d1b5441d54d505329c314
-
SHA1
edc55398cb6484825f70f4cf146832fd4cff154f
-
SHA256
5959ce5cf8681648446f59c475985bc095a179245f12d1d6bfd8f61014a1b998
-
SHA512
c72fb3d6ba563d1f8af7ade956d92b036485d0692dd30ec69d7f2fba90cf833b44eaa0123671f8bcc6783fc8e18079e560207e73c159dbd7f42cdd8c7acc4d55
-
SSDEEP
3072:VtpEAl77/oLjd9FXVlGw0BHKwMek7VB/S7gcEk:BjlE53yHKik7VB+REk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b3582149bc7d1b5441d54d505329c314_JaffaCakes118
Files
-
b3582149bc7d1b5441d54d505329c314_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
98eb5070fc378af00ff27c9c1be1b370
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_wcsrev
wcslen
_wcsnicmp
??2@YAPAXI@Z
wcsstr
wcstok
iswspace
_wcslwr
wcschr
wcspbrk
wcsrchr
memmove
wcsncpy
wcscpy
_itow
iswupper
_wcsupr
wcsncmp
_adjust_fdiv
_initterm
qsort
??3@YAXPAX@Z
free
realloc
malloc
wcstoul
wcscat
iswdigit
_wcsicmp
time
srand
rand
_wtoi
_purecall
oleaut32
VariantClear
VariantChangeTypeEx
VariantInit
VariantCopy
SysAllocString
SysFreeString
SysStringLen
SysAllocStringLen
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
VariantChangeType
LoadRegTypeLi
SetErrorInfo
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
VarI4FromStr
ole32
CoTaskMemRealloc
CoTaskMemAlloc
OleRegGetUserType
StringFromCLSID
CoTaskMemFree
CreateStreamOnHGlobal
GetHGlobalFromStream
CoCreateInstance
kernel32
GetCurrentProcess
HeapDestroy
DisableThreadLibraryCalls
FreeLibrary
SizeofResource
LoadResource
GetVersionExA
FindResourceA
FindResourceW
GetModuleFileNameA
GetModuleFileNameW
LoadLibraryExA
LoadLibraryExW
lstrcmpiA
lstrcmpiW
lstrcmpA
lstrcmpW
lstrcpynW
IsBadWritePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
GlobalSize
GetLastError
MultiByteToWideChar
GlobalAlloc
GlobalReAlloc
GlobalLock
GlobalUnlock
GlobalFree
SetLastError
gdi32
CreatePatternBrush
DeleteObject
SelectObject
SetWindowOrgEx
PatBlt
user32
SetRect
InvalidateRect
InflateRect
SetCursor
GetKeyState
ReleaseDC
GetDC
PtInRect
GetClientRect
ScreenToClient
SetFocus
IsWindow
GetParent
GetWindowLongA
GetWindowLongW
IsCharAlphaNumericA
IsCharAlphaNumericW
IsCharAlphaA
IsCharAlphaW
LoadBitmapA
LoadBitmapW
LoadCursorA
LoadCursorW
LoadStringA
LoadStringW
CharNextW
advapi32
RegEnumKeyExW
RegEnumKeyExA
RegQueryValueExW
RegQueryValueExA
RegSetValueExW
RegSetValueExA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyExA
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 123KB - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ