ICWUTIL.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c00245cf2f7612d0c0b5185cf8cc99b0_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c00245cf2f7612d0c0b5185cf8cc99b0_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c00245cf2f7612d0c0b5185cf8cc99b0_JaffaCakes118
-
Size
148KB
-
MD5
c00245cf2f7612d0c0b5185cf8cc99b0
-
SHA1
cc8d11bd54b7ecd3509af6e4b7809ec1225a1feb
-
SHA256
8bfb5fc2f40fcfab2c74892e9599d2a2bd523837371a9840075dfdbf8fde101d
-
SHA512
a118b1da1b858d5349dfddd85c02bbf9aa40f75e4da6f35ead66538f2a3e6d42d906887f75784e030f35092f0205081c0ae7b63a7946a77168d4626b9c3d84b9
-
SSDEEP
3072:m/3Fo+8/RuNw27x33Um2cK9x/RgT8KHXpq:o3Fovg7xnXKnRg4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c00245cf2f7612d0c0b5185cf8cc99b0_JaffaCakes118
Files
-
c00245cf2f7612d0c0b5185cf8cc99b0_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
290ba9a5469adc4db1acfb1d0d619200
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_adjust_fdiv
_initterm
wcschr
_wcsdup
wcstok
_wtoi
_wtol
malloc
??2@YAPAXI@Z
wcslen
??3@YAXPAX@Z
free
kernel32
GetProcAddress
LoadLibraryA
lstrcatW
lstrcpyW
lstrlenW
VirtualAlloc
SetEvent
lstrcpynW
CreateEventW
lstrcmpiW
CopyFileW
GetUserDefaultLCID
GetLocalTime
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalAlloc
LocalAlloc
WriteFile
CreateFileW
LocalFree
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DeleteFileW
CompareStringW
InterlockedDecrement
InterlockedIncrement
CloseHandle
user32
MsgWaitForMultipleObjects
WaitMessage
ReleaseDC
GetDC
CreateIconIndirect
CharNextW
CharPrevW
TranslateMessage
IsRectEmpty
PostMessageW
LoadStringW
wsprintfW
CopyRect
GetClientRect
DispatchMessageW
PeekMessageW
GetWindowLongW
RegisterClassExW
DefWindowProcW
GetKeyState
SetWindowLongW
MessageBoxW
GetParent
gdi32
SetBkColor
CreateCompatibleBitmap
CreateCompatibleDC
CreateBitmap
GetObjectW
GetDIBits
GetDeviceCaps
BitBlt
PatBlt
SelectObject
CreateSolidBrush
DeleteDC
DeleteObject
advapi32
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
ole32
StringFromCLSID
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
StgCreateDocfile
OleSetContainedObject
OleCreate
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
RegisterServer
URLAppendQueryPair
URLEncode
UnregisterServer
Sections
.text Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 708B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ