d:\work\p2\p2\shareware\Hotab\bin\Hotab.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b6fe4e264e64b6814d121851b26bc4f5_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
b6fe4e264e64b6814d121851b26bc4f5_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b6fe4e264e64b6814d121851b26bc4f5_JaffaCakes118
-
Size
451KB
-
MD5
b6fe4e264e64b6814d121851b26bc4f5
-
SHA1
96abfdc249b453b7f8882e731c7edabd28dca46f
-
SHA256
974b35e4c5a81cc3444f131fc7ed0d4a1785bdc857f424cd1027efc312743dee
-
SHA512
b33fddbbfa03bed68f859c6a609b80cd18ea9bdb249a49592c454967fc7afe141436b7dc5059430886fb52ecd1069d86b0840038fda83ed82f4d9a283294e9a5
-
SSDEEP
12288:qVczLeMjp86uyhX92k5jiKf7Ki9YA/MSTziTEYMkpkPQ1Ao:wczLvBu8Ri47Ki9YAkSTziT0I1v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6fe4e264e64b6814d121851b26bc4f5_JaffaCakes118
Files
-
b6fe4e264e64b6814d121851b26bc4f5_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
ac5734fd2a039b378c3c23f88a25e142
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
shlwapi
StrToIntExA
PathFileExistsA
PathFindFileNameA
StrCmpNIA
StrStrA
StrRChrA
PathAddBackslashA
StrCmpNA
PathStripPathA
PathRemoveExtensionA
SHDeleteKeyA
StrRStrIA
StrNCatA
StrStrIA
wininet
InternetGetConnectedState
InternetConnectA
InternetCrackUrlA
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
InternetOpenA
InternetOpenUrlA
InternetCanonicalizeUrlA
HttpQueryInfoA
InternetQueryOptionA
InternetCloseHandle
kernel32
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
Sleep
GetProcAddress
GetModuleHandleA
lstrlenA
WaitForSingleObject
GetTickCount
CreateEventA
CreateProcessA
CopyFileA
LoadLibraryA
CreateMutexA
ReleaseMutex
CloseHandle
GetCurrentProcessId
CreateThread
lstrcpyA
LocalFree
FindResourceA
LoadResource
InitializeCriticalSection
FindResourceExA
WideCharToMultiByte
SizeofResource
LeaveCriticalSection
MultiByteToWideChar
EnterCriticalSection
LockResource
DeleteCriticalSection
lstrcpynA
GetLastError
FreeLibrary
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
GetSystemTime
SetFileAttributesA
CreateFileA
GetFileSize
SetFilePointer
GetLocaleInfoA
ReadFile
MapViewOfFile
UnmapViewOfFile
SetEvent
CreateFileMappingA
OpenEventA
FileTimeToSystemTime
DeleteFileA
GetFileAttributesA
CreateDirectoryA
SetEndOfFile
GetTempPathA
lstrcmpA
SetLastError
lstrcmpiA
OpenMutexA
TerminateThread
ResetEvent
GetExitCodeThread
GetSystemTimeAsFileTime
WriteFile
GetVolumeInformationA
lstrcatA
GetVersionExA
OpenProcess
TerminateProcess
IsBadReadPtr
GetModuleFileNameA
GetCurrentProcess
Process32First
CreateRemoteThread
VirtualFreeEx
RaiseException
VirtualAllocEx
Process32Next
CreateToolhelp32Snapshot
WriteProcessMemory
HeapFree
GetProcessHeap
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
GetStringTypeW
GetStringTypeA
VirtualAlloc
VirtualFree
HeapCreate
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetFileTime
GetCommandLineA
HeapReAlloc
HeapAlloc
HeapDestroy
GetFileAttributesExA
user32
FindWindowExA
DispatchMessageA
PeekMessageA
TranslateMessage
wsprintfA
ShowWindow
CreateWindowExA
MessageBoxA
DestroyWindow
UnhookWindowsHookEx
GetMessageA
SendMessageA
UnregisterClassA
DefWindowProcA
IsWindow
RegisterClassA
LockSetForegroundWindow
SetWindowLongA
GetWindowLongA
SetWindowPos
GetWindowTextA
GetWindowThreadProcessId
GetSystemMetrics
MsgWaitForMultipleObjects
advapi32
SetSecurityInfo
RegCreateKeyExA
RegQueryValueExA
SetEntriesInAclA
RegOpenKeyA
RegOpenKeyExA
RegFlushKey
RegCloseKey
RegSetValueExA
RegEnumKeyExA
RegDeleteValueA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
shell32
SHGetSpecialFolderPathA
ShellExecuteA
ole32
CoUnmarshalInterface
CoMarshalInterface
CoReleaseMarshalData
CreateStreamOnHGlobal
CoInitializeEx
CoInitialize
CoUninitialize
CoCreateInstance
oleaut32
GetErrorInfo
VariantCopy
VariantInit
VariantClear
SysAllocString
SysFreeString
Exports
Exports
DllCanUnloadNow
DllRegisterServer
DllUnregisterServer
GetProtectedKeys
SetSecondStorage
_NotifyShutdown@4
_NotifyStartup@4
autorun
startup
Sections
.text Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ