ElsCore.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bd39b9d78b4ae5a569ae087f742f3bc2_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
bd39b9d78b4ae5a569ae087f742f3bc2_JaffaCakes118
-
Size
136KB
-
MD5
bd39b9d78b4ae5a569ae087f742f3bc2
-
SHA1
4213b488916aed4c3607b58e80ee0981af612ef8
-
SHA256
3f48a18599789c23926117fc22dff01b72e79bc09de42c7d469719bd5b5f40a6
-
SHA512
7c12fb3fb0cb61fcbd6f6ea297fd5770faadb0df4872bca0ad5d5206cab05754ab0faa938a078306bd2fbf25b4263874d35ed1d166bf25ed351652f6576bd59a
-
SSDEEP
3072:AOR8LYYR6/CjhGUU3x3S27sLaafG/As4qNttjWF2aimxX:HUxRjGWFmm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bd39b9d78b4ae5a569ae087f742f3bc2_JaffaCakes118
Files
-
bd39b9d78b4ae5a569ae087f742f3bc2_JaffaCakes118.dll windows:6 windows x86 arch:x86
8c4d0155859f046651d078513f45c98f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
memset
_fileno
_read
__pioinfo
__badioinfo
realloc
wcstombs
iswctype
wctomb
localeconv
isxdigit
isleadbyte
__mb_cur_max
mbtowc
isdigit
calloc
memcpy
_amsg_exit
_initterm
free
malloc
_XcptFilter
_errno
ungetc
ntdll
RtlInitUnicodeString
RtlGUIDFromString
RtlUnwind
kernel32
LoadLibraryA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
OutputDebugStringA
InterlockedCompareExchange
Sleep
InterlockedExchange
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
GetModuleHandleExW
LeaveCriticalSection
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
HeapCreate
LoadLibraryW
ReadFile
CreateFileW
CloseHandle
GetProcAddress
FindFirstFileW
FindClose
GetModuleHandleW
GetModuleFileNameW
GetCurrentProcess
IsWow64Process
GetSystemWow64DirectoryW
GetSystemDirectoryW
QueueUserWorkItem
GetLastError
DisableThreadLibraryCalls
GetProcessHeap
advapi32
RegCloseKey
RegEnumKeyW
RegOpenKeyExW
RegQueryValueExW
Exports
Exports
MappingDoAction
MappingFreePropertyBag
MappingFreeServices
MappingGetServices
MappingRecognizeText
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ