WMM2AE.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b8c8b581c18beef7bf4b76b8d8b754ff_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b8c8b581c18beef7bf4b76b8d8b754ff_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b8c8b581c18beef7bf4b76b8d8b754ff_JaffaCakes118
-
Size
262KB
-
MD5
b8c8b581c18beef7bf4b76b8d8b754ff
-
SHA1
a84a36d9d5084bd295c36b7aa226418dd97ba17b
-
SHA256
16211080196a251d916f9e33a4aaabe8dd388920834410f75c7d5e805c135cd6
-
SHA512
adc7998917db681a4a7f20aa9ca353b3c7a77c62f71808c78703f0293f29d1ab869d9b7c5bdd87875968db543ee33aa962f1691d6a25ef010bda83b5b6a70db2
-
SSDEEP
6144:Ha7q6ZavPT5C8lT8Vn3kgIRGMliNYeUEOYBSE2G5:67qhvFC0T81a8hNYeUOBd5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8c8b581c18beef7bf4b76b8d8b754ff_JaffaCakes118
Files
-
b8c8b581c18beef7bf4b76b8d8b754ff_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
301e8f9d0e32aa6e055b52228c5fc6d8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_initterm
_adjust_fdiv
__dllonexit
_onexit
malloc
_wcsicmp
??2@YAPAXI@Z
realloc
free
_ftol
_purecall
wcsncpy
__CxxFrameHandler
fclose
wcscat
wcscpy
wcslen
wcsrchr
printf
_wcsnicmp
rand
srand
time
_CIexp
_wsplitpath
_except_handler3
??3@YAXPAX@Z
kernel32
lstrlenW
LoadLibraryA
CompareFileTime
GetTickCount
GetTempFileNameW
GetTempPathW
lstrcpyW
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
lstrcatW
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryW
DisableThreadLibraryCalls
GetShortPathNameW
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrcpynW
lstrcmpW
Sleep
CreateEventA
GetCurrentThread
GetThreadPriority
CreateThread
SetThreadPriority
SetEvent
WaitForSingleObject
GetSystemInfo
IsBadWritePtr
FormatMessageW
LocalFree
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetLastError
CloseHandle
user32
CharNextW
GetDC
ReleaseDC
PostMessageW
SendMessageW
LoadStringW
ole32
CoFreeUnusedLibraries
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
oleaut32
SysStringLen
SysFreeString
SysAllocStringLen
VariantClear
SysAllocString
LoadTypeLi
RegisterTypeLi
LoadRegTypeLi
gdi32
GetStockObject
GetObjectA
DeleteObject
advapi32
RegEnumValueW
RegOpenKeyExW
RegCloseKey
GetUserNameW
gdiplus
GdipDeleteFont
GdipDeleteFontFamily
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipFree
GdipBitmapUnlockBits
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetFamilyName
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipBitmapLockBits
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipGetFamily
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ