d:\td\tao911\tao911\Release\tao911.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b9b074368331c3cd51849df063985628_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
b9b074368331c3cd51849df063985628_JaffaCakes118
-
Size
242KB
-
MD5
b9b074368331c3cd51849df063985628
-
SHA1
a5b37bc9cf1d98ebb68da1e5553bfb528af2396d
-
SHA256
af1b486d24ee953e9830bc0e8a0310f3cfca3a9fd011989b4ce975f175e5af3e
-
SHA512
785c35f754ca99bfa8a12168b100f8db01b301b3ea8e3fb4d8d93188f319a6e7b0e3dda04d08e756aa8787886cde64ace798471560cea51f19ecb27a191a9e15
-
SSDEEP
3072:2C/Uexn8IyXvbNLj485YgP1Fj5xRf0nndFdqXLozc+aFzI3vY/H4059JMQI:2CivpegrJ4ndFQbec+UzL59xI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b9b074368331c3cd51849df063985628_JaffaCakes118
Files
-
b9b074368331c3cd51849df063985628_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
d011e21ac6c97400b94b4ee8571f754c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LeaveCriticalSection
GetLastError
GetProcAddress
GetModuleHandleA
lstrlenA
lstrcmpiA
GetModuleFileNameA
GetModuleHandleW
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
EnterCriticalSection
LoadLibraryA
CloseHandle
WaitForSingleObject
CreateProcessA
GetLocalTime
CreateMutexA
SetThreadLocale
GetThreadLocale
HeapFree
GetProcessHeap
FlushFileBuffers
CreateFileA
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
GetWindowsDirectoryA
RaiseException
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
ReadFile
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
HeapAlloc
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
VirtualFree
HeapReAlloc
HeapCreate
HeapDestroy
WriteFile
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
user32
CharNextA
CharNextW
IsCharAlphaNumericA
advapi32
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
ole32
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
oleaut32
VariantClear
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysFreeString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 91KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ