colbact.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b9d93334e749d0a95ff5657151b46504_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b9d93334e749d0a95ff5657151b46504_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b9d93334e749d0a95ff5657151b46504_JaffaCakes118
-
Size
125KB
-
MD5
b9d93334e749d0a95ff5657151b46504
-
SHA1
e7f9aa507d8e08358490533ed2ec535466735db5
-
SHA256
63b3ee04b94b31dc18eef68fb43cf58fcccda20264de9f133a3657e3adf807c8
-
SHA512
b0856cd33b14ea996bf528934f34d8f483abd280eef3607fb520c19d0d01302614a3d252012073590e624611794c1d59617d4281fcd8b907841578ba4cd343f5
-
SSDEEP
3072:LrdGgLMagWqMyNux7GzpJ3qMCUfrzPe3TSG:ogTRyg6zoIrzPS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b9d93334e749d0a95ff5657151b46504_JaffaCakes118
Files
-
b9d93334e749d0a95ff5657151b46504_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
307de1671610ff9bcb018baa9961276b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
user32
LoadStringW
wsprintfW
CloseDesktop
GetThreadDesktop
SetThreadDesktop
OpenDesktopW
DialogBoxParamW
EndDialog
SetDlgItemTextW
CloseWindowStation
GetProcessWindowStation
wsprintfA
SetWindowPos
MapWindowPoints
GetClientRect
GetWindowRect
GetDesktopWindow
SetProcessWindowStation
OpenWindowStationW
kernel32
GetModuleHandleW
lstrlenW
lstrcatW
lstrcpyW
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
GetProcAddress
FreeLibrary
OutputDebugStringA
GetLastError
LoadLibraryW
WaitForSingleObject
CreateThread
CreateEventA
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
GetTickCount
InterlockedExchange
InterlockedCompareExchange
CloseHandle
TlsSetValue
TlsGetValue
GetCurrentProcess
GetCurrentThread
LoadLibraryA
TlsFree
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
GetVersionExA
GetSystemInfo
GetModuleFileNameW
Sleep
SetEvent
ReleaseSemaphore
lstrcpynW
FormatMessageW
LockResource
LoadResource
FindResourceW
ReleaseMutex
FindClose
DeleteFileW
SetFileAttributesW
FindNextFileW
FindFirstFileW
GetExitCodeProcess
CreateProcessW
ExpandEnvironmentStringsW
CreateDirectoryW
GetLocalTime
DebugBreak
GetThreadContext
IsDebuggerPresent
LoadLibraryExW
CreateFileW
GetWindowsDirectoryW
InitializeCriticalSection
WriteFile
SetFilePointer
LocalFree
lstrcatA
lstrcpyA
GetModuleFileNameA
VirtualQueryEx
DisableThreadLibraryCalls
DeleteCriticalSection
lstrcmpiW
CreateSemaphoreA
TlsAlloc
DelayLoadFailureHook
OpenMutexW
MapViewOfFile
OpenFileMappingW
CompareFileTime
CreateFileMappingW
QueryPerformanceCounter
CreateMutexW
ole32
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoGetObjectContext
advapi32
EqualSid
SetEntriesInAclW
IsValidSid
CheckTokenMembership
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
OpenThreadToken
OpenProcessToken
GetTokenInformation
GetLengthSid
CopySid
DuplicateToken
RegNotifyChangeKeyValue
AllocateAndInitializeSid
FreeSid
RegSetValueExW
rpcrt4
UuidToStringW
RpcStringFreeA
RpcStringFreeW
UuidFromStringA
RpcRevertToSelf
RpcImpersonateClient
UuidToStringA
version
VerQueryValueW
msvcrt
_wstrtime
wcsrchr
__CxxFrameHandler
malloc
free
_initterm
_adjust_fdiv
__dllonexit
_onexit
_waccess
_CIfmod
_ftol
floor
wcscat
wcscpy
wcslen
_purecall
sprintf
_except_handler3
_vsnwprintf
rand
srand
time
_wstrdate
wcscmp
ntdll
RtlInitializeCriticalSection
DbgPrint
comres
COMResModuleInstance
secur32
GetUserNameExW
Exports
Exports
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetClassInfoForCurrentUser
GetDefaultPartitionForCurrentUser
GetDefaultPartitionForSid
PartitionAccessCheck
Sections
.text Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ