e:\FF\build_system\non_templates\JS_Hijack\Release\JS_Hijack.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b6143024a934f0e142a91543e3f030ed_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
b6143024a934f0e142a91543e3f030ed_JaffaCakes118
-
Size
205KB
-
MD5
b6143024a934f0e142a91543e3f030ed
-
SHA1
b6e84c6d7c9607e6acad99200e6bc450e602bcd7
-
SHA256
6010c157cfd40370f7a7c3d680ea3ae10fbce41828517ccf0c04d8d361067962
-
SHA512
b028da1dbef4c6fd9069a77affdec1996961d0b4cff9c92626dfed88f44053eaf010d0671f551657393a366de904a700f40d966fcbc295edee5b4318020963e2
-
SSDEEP
3072:ZYo8OhQ8sCIIvv7aE/gGd4aL31PgFboeMatJiK8v8DaJ/83mH495iJ0h:xdRPgFboCTlaJEWYS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6143024a934f0e142a91543e3f030ed_JaffaCakes118
Files
-
b6143024a934f0e142a91543e3f030ed_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
c7be21027dbd52451943bda528c26cea
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FindResourceA
FindResourceExA
GetLastError
GetProcAddress
GetModuleHandleA
lstrlenA
lstrcmpiA
InterlockedIncrement
InterlockedDecrement
IsDBCSLeadByte
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
LoadResource
LoadLibraryExA
GetModuleHandleW
SetThreadLocale
GetThreadLocale
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
CompareStringW
CompareStringA
FlushFileBuffers
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
FreeLibrary
MultiByteToWideChar
CloseHandle
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryA
InterlockedExchange
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
GetCurrentThreadId
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
FatalAppExitA
VirtualFree
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEnvironmentVariableA
user32
CharNextW
CharNextA
advapi32
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
ole32
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
oleaut32
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
LoadRegTypeLi
DispCallFunc
SysStringLen
VariantInit
VarUI4FromStr
SysAllocString
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
VariantClear
SysFreeString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 155KB - Virtual size: 155KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ